IP Ban Hammer

# IP Ban Hammer Allow List
# 每行一个IP或CIDR，#开头的行为注释

# 单个 IP
127.0.0.1
192.168.1.100

# CIDR 网段
10.0.0.0/8           # 内网 10.x.x.x
172.16.0.0/12        # 内网 172.16-31.x.x
192.168.0.0/16       # 内网 192.168.x.x

# 搜索引擎 IP 段（可选）
66.249.64.0/19       # Google
123.125.0.0/16       # Baidu
220.181.0.0/16       # Baidu

/opt/ip-ban-hammer/               # 脚本目录
├── bin/
│   ├── auto_ban_attacks.py      # 日志分析器 - 定时分析
│   ├── full_scan.py             # 全量扫描 - 手动分析
│   ├── apply_iptables_ban.sh    # 应用iptables规则
│   ├── ban_manager.sh           # 管理工具
│   └── uninstall.sh             # 卸载脚本
├── config/
│   ├── security.conf.example    # 配置示例
│   └── allow.list.example       # 白名单示例
├── lib/
│   ├── ipban_core/              # 共享模块库
│   │   ├── __init__.py          # 模块入口
│   │   ├── patterns.py          # 攻击模式定义
│   │   ├── validators.py        # IP/CIDR 验证
│   │   ├── config.py            # 配置加载
│   │   ├── whitelist.py         # 白名单处理
│   │   ├── alert.py             # 告警通知
│   │   ├── migration.py         # 配置迁移
│   │   ├── backup.py            # 备份回滚
│   │   └── log_parser.py        # 日志解析
│   └── completion/
│       └── ipban.bash            # Bash补全
└── systemd/                      # systemd 服务文件（可选）
    ├── ipban-analyze.service
    ├── ipban-analyze.timer
    ├── ipban-apply.service
    ├── ipban-apply.timer
    ├── ipban-cleanup.service
    └── ipban-cleanup.timer

/etc/ip-ban-hammer/               # 运行时配置
├── security.conf                # 运行时配置（修改此文件生效）
├── allow.list                   # 白名单
└── i18n/
    └── zh.lang                  # 语言文件

/var/lib/ip-ban-hammer/           # 数据文件
├── pending.list                 # 待封禁IP
├── applied.list                 # 已封禁IP
├── config_backups/              # 配置备份目录
│   ├── security.conf.YYYYMMDD_HHMMSS  # 配置备份文件
│   └── backup_history.log      # 备份历史记录
└── backups/                     # iptables备份目录
    └── backup_YYYYMMDD_HHMMSS/  # 备份文件

/var/log/ip-ban-hammer/           # 日志文件
├── main.log                     # 运行日志
├── history.log                  # 封禁历史
├── stats.log                    # 统计数据
└── ipv6_detected.log            # IPv6检测日志

# IP Ban Hammer Allow List
# One IP or CIDR per line, # for comments

# Single IPs
127.0.0.1
192.168.1.100

# CIDR ranges
10.0.0.0/8           # Private network 10.x.x.x
172.16.0.0/12        # Private network 172.16-31.x.x
192.168.0.0/16       # Private network 192.168.x.x

# Search engine IP ranges (optional)
66.249.64.0/19       # Google
123.125.0.0/16       # Baidu
220.181.0.0/16       # Baidu

/opt/ip-ban-hammer/               # Scripts
├── bin/
│   ├── auto_ban_attacks.py      # Log analyzer - scheduled
│   ├── full_scan.py             # Full scan - manual
│   ├── apply_iptables_ban.sh    # Apply iptables rules
│   ├── ban_manager.sh           # Management tool
│   └── uninstall.sh             # Uninstall script
├── config/
│   ├── security.conf.example    # Config example
│   └── allow.list.example       # Whitelist example
├── lib/
│   ├── ipban_core/              # Shared module library
│   │   ├── __init__.py          # Module entry
│   │   ├── patterns.py          # Attack patterns
│   │   ├── validators.py        # IP/CIDR validation
│   │   ├── config.py            # Config loading
│   │   ├── whitelist.py         # Whitelist handling
│   │   ├── alert.py             # Alert notifications
│   │   ├── migration.py         # Config migration
│   │   ├── backup.py            # Backup & rollback
│   │   └── log_parser.py        # Log parsing
│   └── completion/
│       └── ipban.bash            # Bash completion
└── systemd/                      # systemd service files (optional)
    ├── ipban-analyze.service
    ├── ipban-analyze.timer
    ├── ipban-apply.service
    ├── ipban-apply.timer
    ├── ipban-cleanup.service
    └── ipban-cleanup.timer

/etc/ip-ban-hammer/               # Runtime config
├── security.conf                # Runtime config (edit this)
├── allow.list                   # Whitelist
└── i18n/
    └── en.lang                  # Language file

/var/lib/ip-ban-hammer/           # Data files
├── pending.list                 # Pending bans
├── applied.list                 # Applied bans
├── config_backups/              # Config backup directory
│   ├── security.conf.YYYYMMDD_HHMMSS  # Config backup files
│   └── backup_history.log      # Backup history
└── backups/                     # iptables backup directory
    └── backup_YYYYMMDD_HHMMSS/  # Backup files

/var/log/ip-ban-hammer/           # Log files
├── main.log                     # Runtime log
├── history.log                  # Ban history
├── stats.log                    # Statistics
└── ipv6_detected.log            # IPv6 detection log