Automatic IP ban (Autoban)

Drupal 8 version

Autoban allows to automatize IP ban using watchdog table by the module rules. Need enable Database logging module (core) and at least one IP Ban Providers submodule: Autoban Core Ban (integrate with core Ban module) and/or Autoban Advanced Ban (integrate with Advanced Ban module.

Rule module finds IP in watchlog table entries and do IP Ban using Ban Provider. Advanced Ban provider supports IP address range and blocked IP expire. IP blocking by cron or manually.

Drupal 7 version

Autoban allows to automatize IP ban using watchdog table by the module rules. Need enable Database logging module (core). The module ban IP by cron (cron mode) or at every dblog event (force mode).

Rule module finds IP in watchlog table entries and inserts IP to banned IP table. By default, IP is inserted into blocked_ips table (admin/config/people/ip-blocking). After installing IP_ranges module you can ban IP range (aaa.bbb.ccc.0 - aaa.bbb.ccc.255).

Autoban module supports Blocked IPs Expire module, which unblocking IP addresses after a certain amount of time. Just install the module and use Single ban.

Rules for ban IP consist of:

• Type (watchdog type, like "page not found")
• Message pattern (rules seek in watchdog message as "LIKE %message_pattern%"). Multiple patterns available("|" divider).
• The threshold number of log entries.
• User type (anonymous, authenticated or any).
• User referrers
• Type IP (single or range). Needs installing IP_ranges module for range ban.

The module can check search engines bots IP by Whitelist (for example, ip2location.com or iplists.com). You can also use Whitelist of IP_ranges module.

There is a submodule Autoban Watchdog Event Extras which inserting IP Ban links to watchdog event page. Autoban module has VBO module integration.

Similar modules

• Smart IP Ban - banned using flood table.
• path2ban - banned using bots paths.
• Spammer Node Add (Spamna) - banned for node/add bots.

How to use

1. Install autoban module.
2. Analyze watchdog table (/admin/reports/dblog) manually or using analyze page (/admin/people/autoban/analyze). Go to the test page during analysis.
3. Go to the autoban admin page (/admin/config/people/autoban). Create and test rules. Show country, region and city info of the IP by freegeoip.net.
4. Cron will be ban IP using autoban rules. Check it at IP address blocking (/admin/config/people/ip-blocking) and IP range bans (/admin/config/people/ip-ranges) pages. Or you can ban IP manually using analyze page or watchdog event page.

Troubleshooting

• You need use non translated values for type and message of the module rules.
• Autoban using cron for automatic IP ban. If cron is disabled, you can click "Ban IPs" button at module administration page.
• Autoban prevents own IP ban (as single IP or IP included in the banned range). If you have a dynamic IP, there is a risk of its own ban. In this case it is better to choose a range type in module rules, instead a single type.
• New module users, who installed 7.x-1.5 may get error message about missing referer column. Please uninstall and remove it and install 7.x-1.6 . Please do not update. If you have already updated to 7.x-1.6 version, please uninstall and remove it and install 7.x-1.6 again.
  Or you can manually execute sql " ALTER TABLE `autoban` ADD `referer` LONGTEXT NULL COMMENT 'URL of referring page.'" also.
  Sorry for the inconvenience.