# AbuseTrack firewall blocklist

Loads the AbuseTrack community blocklist into your server's firewall and keeps
it fresh. IPs that other AbuseTrack users caught attacking are dropped before
they reach SSH, web, mail or any other service.

## Install

As root, with an API key from <https://abusetrack.io/account/api-keys>:

```bash
curl -fsSL https://abusetrack.io/integrations/firewall/install.sh | \
  AT_API_KEY=your_api_key bash
```

The installer:

1. detects the firewall (`ufw` if active, otherwise `nftables`, otherwise
   `iptables` with `ipset`) and installs `nftables` or `ipset` if missing,
2. writes `/etc/abusetrack/blocklist.conf` (mode 600),
3. installs `/usr/local/sbin/abusetrack-blocklist`,
4. schedules a sync every 30 minutes (systemd timer, cron as fallback),
5. loads the list once and prints the status.

## Options

| Variable          | Default                  | Meaning                                              |
| ----------------- | ------------------------ | ---------------------------------------------------- |
| `AT_API_KEY`      | required                 | Your API key                                         |
| `AT_API_URL`      | `https://abusetrack.io`  | Base URL of the AbuseTrack instance                  |
| `AT_FIREWALL`     | `auto`                   | `nftables`, `iptables` or `ufw`                      |
| `AT_MIN_SCORE`    | `50`                     | Minimum community risk score (0-100)                 |
| `AT_MAX_ENTRIES`  | `100000`                 | Upper bound of loaded entries                        |
| `AT_INTERVAL_MIN` | `30`                     | Sync interval in minutes (5-1440)                    |
| `AT_ALLOWLIST`    | empty                    | IPs/CIDRs that are never blocked                     |
| `AT_INSTALL_DEPS` | `1`                      | Install `nftables`/`ipset` if missing                |

## How it blocks

- **nftables:** own table `inet abusetrack` with `input` and `forward` chains
  at priority -10. It does not touch your other tables.
- **iptables / ufw:** `ipset` sets `abusetrack-block4/6` and
  `abusetrack-allow4/6`, and a chain `ABUSETRACK` hooked at the top of
  `INPUT` and `DOCKER-USER` (or `FORWARD`). ufw's own rules stay untouched.
  Every sync re-checks the hooks, so a `ufw reload` is repaired within one
  interval.

Published Docker ports are covered through the `forward` hook or
`DOCKER-USER`.

## Safety

- Updates are atomic (one nft transaction or an `ipset swap`).
- A failed download never empties the firewall. The last good list is
  re-applied, for example right after a reboot.
- Private, loopback and link-local ranges are never blocked.
- The SSH address you install from is added to the allowlist, so you cannot
  lock yourself out. Edit `AT_ALLOWLIST` in the config to change it.
- Malformed lines are dropped before they reach the firewall.

## Commands

```bash
abusetrack-blocklist status   # backend, entries, tier, drop counters
abusetrack-blocklist sync     # sync now
abusetrack-blocklist remove   # remove all firewall objects (config stays)
tail -f /var/log/abusetrack-blocklist.log
```

## Give-to-get

Accounts that report attacks receive the **full real-time** feed and extra API
requests. Other accounts get a capped feed in which new IPs appear after a
delay. `abusetrack-blocklist status` shows your current tier.

To report from the same server, add a reporter:

- fail2ban: `curl -fsSL https://abusetrack.io/integrations/fail2ban/install.sh | AT_API_KEY=... bash`
- CrowdSec: `curl -fsSL https://abusetrack.io/integrations/crowdsec/install.sh | AT_API_KEY=... bash`

## Uninstall

```bash
curl -fsSL https://abusetrack.io/integrations/firewall/install.sh | bash -s -- uninstall
```

This removes the timer, the firewall objects, the script and the config.