IPBan

IPBan is an open-source web app and server that protects servers by blocking malicious IP addresses. It monitors system logs and event viewers to detect failed login attempts, automatically updating firewall rules to ban intruders. The software is available for Windows and various Linux distributions, including Ubuntu, Debian, CentOS, and RedHat, making it a versatile choice for managing network security across different operating systems.

Users install the application as a background service to ensure continuous monitoring. On Windows, it is deployed via a PowerShell script, while Linux installations are handled through a bash script. The software supports both IPv4 and IPv6 across all compatible platforms and requires administrative or root privileges to manage firewall rules. It is designed to run on Windows 10 or newer and Windows Server 2016 or newer, as well as x64 and ARM architectures on supported Linux distributions.

Key features

• Automatic banning of IP addresses based on failed login detection
• Support for Windows Event Viewer and text-based log files
• Default monitoring for SSH on Linux and RDP, MySQL, and SQL Server on Windows
• Configurable thresholds for failed login counts and ban durations
• Instant banning for event viewer triggers and adjustable polling for log files
• Simple unbanning process via a text file in the service folder
• Integration with IPThreat for community-submitted bad IP addresses
• Compatibility with firewalld, nftables, and iptables on Linux

Built using .NET, the application is designed for server administrators who need to mitigate botnets and brute-force attacks. It allows for the addition of custom application recipes via a configuration file to extend monitoring beyond the default services, such as Exchange, SmarterMail, and MailEnable. The architecture focuses on speed to ensure that the firewall implementation remains the only primary bottleneck in the banning process. Users can build a self-contained executable to eliminate the need for the .NET runtime on the server machine.

IPBan serves as a security layer for dedicated or cloud servers requiring automated intrusion prevention and threat detection.