There are several comprehensive lists of known bad actor IP addresses.
How to create a blacklist of IP addresses on the RV34x?
I have checked all available options in the admin GUI, plus all available documentation and it seems there is no way to do this.
If there is no way, that is a very regrettable limitation.
Perhaps Cisco wants to force license subscriptions of their version of such security?
That is not a solution unfortunately. Your suggestion to use ACLs would require entering hundreds or thousands of single IP addresses. Entering IP address ranges would block too many unintended websites/servers - although I don't know what you mean exactly by networking the list of IPs.
I superscope my IP blocks into networks. It is the way I work. Using a Class A block would block a lot more IPs than I would want to make a list of. Lists to me are small scale.
Hi, please let me know which lists you a referring to.
IP Reputation and Webreputation is typically a professional service which costs money. Generating, Verifying, and Managing these lists is a lot of effort. Especially adding IP addresses is best done as a cloud service.
Webreputation can be done very easily and for free with Cisco Umbrella.
But you are correct, the add-on security licnese will enable a set of advanced security features, like web reputation. It will block automatically dangerous web addresses.
Another way is to block and allow specific apps. The Rv340 inspects and identifies more than 500 different internet apps which you can use to allow or block.
Hope this helps.
Hi, how many IP addresses to you want to block ? You can block single or a range or a subnet.
Do you want to import a list of IP addresses?
You can set up different rules for different local IP Groups or device types.
Hope you can help me better understand the requirement.
OK, you should have read the thread to understand the requirement.
The intent is to block many individual IP addresses.
Blocking ranges it not option, that would block too many unintended sites.
Blocking individual IP addresses is not an option there are way too many.
Access Control Rules wont work for those reasons.
Further, Rutgers University CS Dept. has comprehensive telemetry and provides tremendous insight into attacker IP Addresses:
They supply lists of hundreds if not thousands of individual addresses:
There are many such lists:
The benefit for blocking many discreet addresses with one rule should be obvious.
This could be done with Access Control Lists.
I block big ranges with ACLs. If I need access to an IP address or range then I modify my ACL lists. I think you are thinking about this too hard. As far as testing rules it is going to be the same. Using ranges and class address blocking is going to make you router faster. I would rather block a class b than a 1000 IP addresses. It is more efficient. Over laps can be fixed if you need it.
Sorry if I ask too many questions. I just want to understand better what your requirements are and how many IP addresses you want to block and also how you want to manage these IP addresses.
For an SMB firewall it is much better from a perfromance point of view to follow what @leecoxhouse1 recommends.
Form a security point of view you can add this by using a dynamic IP reputation service maintained by a Threatintelligence company. These provide in almost realtime IP reputations for web addresses and can block dangerous websites based on several rules ( who owns them, how many webaddresses do they have ,are they brand new ). They can identify Spammers and Threats very quickly.
( Of course i recommend Cisco Umbrella or OpenDNS it is run by Cisco)
You do not want to get your hosts to dangerous IP addresses use a threat intelligence service. You do want to block specific addresses use the ACL or the content filter. You can also block your hosts from using internet applications on the RV340, like torrents etc.
If you want to block advertisements check out https://en.wikipedia.org/wiki/Pi-hole.