IPQ BDB filter

IPQ BDB filter is a user space daemon designed to filter IP addresses by consulting a Berkeley DB, with the primary aim of mitigating dictionary attacks and compulsive spammers. Its fuzzy blocking model increases the probability of blocking an IP address each time it is flagged for suspicious activity, eventually reaching full blocking after a set number of incidents. This probability subsequently decays over time, allowing previously blocked addresses to be rehabilitated automatically without manual intervention.

The tool operates as a component that users can incorporate into their firewall setup. It requires the user to configure their firewall rules, including regular expressions, blocking probabilities, and halving times. Integration with firewall software is achieved through iptables with NFQUEUE targets or nftables queue statements, leveraging the nfnetlink_queue kernel facility. The package includes not only the main daemon but also a log parser and command-line utilities for inserting or deleting IP addresses in the Berkeley DB. 00 introduced support for IPv6, with separate database files created for each protocol version.

IPQ BDB filter depends on several libraries and packages, including Netfilter libraries, libnetfilter_queue, libnfnetlink, libmnl, Berkeley DB, PCRE, and Popt. The optional libcurl library can be used for abuse reporting. 14 or later, as it relies on Netfilter. The package is distributed under the GNU General Public License v3 or later, and its development status is listed as production/stable.

This software is not part of the GNU Project but is hosted on Savannah as non-GNU software and documentation. It is positioned as a building block for custom firewall solutions, with similar projects including SSHGuard and Fail2ban mentioned for context. The tool is suitable for administrators seeking automated, probabilistic IP blocking and rehabilitation mechanisms within their Linux firewall configurations.