IPBan 3.0.0

• .NET 9.0
• Normalize log file regex to better detect new or duplicate config entries
• Fix for importing too many banned ips into the database at service start. Only the default block rule is imported now.
• Optimize Linux iptables firewall for huge performance boost.

IPBan 2.0.1

Last update 2024-11-09T19:38:00Z.

• Replace WMIC with PInvoke on Windows for account names and active status retrieval. WMIC is deprecated as of Windows Server 2025.
• Allow multiple event viewer groups to process an event.
• Fix issue where some windows event viewer successful logins weren't getting logged.

IPBan 2.0.0

Last update: 2024-08-31T19:33:00Z.

• .NET 8 Build.
• Allow override min time between failed logins for log files and event viewer expressions to block.
• Sort firewalld rules in the xml by priority, in case the underlying implementation doesn't honor priority.
• Allow $ts$ replacement to machine timestamp in ticks for firewall uri rules (cache busting).
• Handle closed or reset in openssh logs for invalid users.
• Remove WFP blocked packet blocking from default config.
• Add new mail enable failed login to default config.
• Log files exceeding max size are truncated now instead of deleted to maintain file permissions.

IBPan 1.9.0

Last update 2023-10-11T15:28:00Z

This release contains firewalld support and makes firewalld the default firewall for Linux. The public zone is used for all the rules along with firewalld ipsets to store the ip addresses of each rule.

Also added a timestamp_utc option for parsing of event viewer and log files. If used, the timestamp will be assumed to be in utc time and not local time, unless a time zone is explicitly in the parsed timestamp, in which case that will be used.

IPBan 1.8.1

Last update: 2023-07-04T17:38:00Z

• User name truncation. The TruncateUserNameChars property can be used to configure behavior of user name truncation. '@' is the current default, meaning email addresses will be truncated to just the username, i.e. '[email protected]' will become 'bob' by default.
• Don't log config error if config item is missing or empty.
• Logging for ignored internal ip addresses and why they were ignored.
• Fix an issue where base config (ipban.config) did not change but the override config (ipban.override.config) did and log files could stack endlessly.
• Fix an issue computing the local ip address when ipv4 and ipv6 adapters were on the machine.
• Attempt to fix possible Linux timer issue for running cycles.
• Ensure legacy iptables is used on Linux.

IPBan 1.8.0

• [2022-09-21] Critical memory leak fix, please re-download and re-deploy 1.8.0 version if installed before 2022-09-21
• Integration with https://ipthreat.net (see https://ipthreat.net/integrations/ipban)
• Fix issue not using dns ip addresses for failed logins
• Fix issue when expressions to block and/or expressions to notify element was removed entirely from config
• New "log" group for regex to capture relevant log snippet, will be displayed on failed logins logging and sent to ipthreat api if enabled
• Refactor cycle tasks to ensure each task executes regardless of whether other tasks throw exceptions
• App setting values may be formatted with %[env_var_name]% to read the value from environment variables

IPBan 1.7.3

• Fix an issue with override config that would not copy appSettings/add elements if the base config did not also have the same key.
• Attempt to fix an issue where editing the override config frequently could result in the override config not being merged properly.
• Improve sql server negation expression in event viewer check.
• Show source when ip address parse fails and a dns lookup is performed.
• Perform web service call to https://api.ipban.com/myip to get ip address if external ip cannot be found.
• Can add a max count to end of firewall uri rule to allow more than 10k ip addresses.

IPBan 1.7.2

• Fix an issue not unbanning ipv6 properly in Windows Firewall
• Fix an issue on Linux iptables with ranges that were not proper cidr mask ranges
• Detect successful ssh logins on Linux and Windows using certificates
• Don't ban 404 errors in Tomcat, this would cause missing favicon, apple touch icon, etc. to ban incorrectly

IPBan 1.7.1

• Add additional Linux failed login files ( /var/log/httpd/access_log, /var/log/messages)
• Reduce memory usage slightly
• Reduce logging spam further. To see more detailed logging, set nlog.config levels to Debug.
• Allow process to run on ban/unban to be newline separated for multiple processes

IPBan 1.7.0

• Upgrade to .NET 6
• Significant RAM usage improvement