Scalable Stories

Trusted IP Lists for FirewallD, NGINX and fail2ban

Play Episode Pause Episode

1x

00:00 / 00:11:37

Apple Podcasts

RSS Feed

Share

Link

Embed

<blockquote class="wp-embedded-content" data-secret="6yD5S8394S"><a href="https://www.getpagespeed.com/podcast/trusted-ip-lists-audio">Trusted IP Lists for FirewallD, NGINX and fail2ban</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://www.getpagespeed.com/podcast/trusted-ip-lists-audio/embed#?secret=6yD5S8394S" width="500" height="350" title="&#8220;Trusted IP Lists for FirewallD, NGINX and fail2ban&#8221; &#8212; GetPageSpeed" data-secret="6yD5S8394S" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script> /*! This file is auto-generated */ !function(d,l){"use strict";l.querySelector&&d.addEventListener&&"undefined"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),o=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),c=new RegExp("^https?:$","i"),i=0;i<o.length;i++)o[i].style.display="none";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute("style"),"height"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):"link"===t.message&&(r=new URL(s.getAttribute("src")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",function(){for(var e,t,s=l.querySelectorAll("iframe.wp-embedded-content"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute("data-secret"))||(t=Math.random().toString(36).substring(2,12),e.src+="#?secret="+t,e.setAttribute("data-secret",t)),e.contentWindow.postMessage({message:"ready",secret:t},"*")},!1)))}(window,document); //# sourceURL=https://www.getpagespeed.com/wp-includes/js/wp-embed.min.js </script>

Technical Briefing: Trusted IP List Packages for FirewallD, NGINX, and fail2ban

The Problem

Hardcoded allowlists for services like Stripe webhooks, Cloudflare, and Googlebot go stale silently. When vendors rotate their published IP ranges, existing allowlists stop matching — breaking integrations or blocking legitimate traffic without any obvious failure signal.

The Fix

The GetPageSpeed trusted-lists project packages current, officially published IP ranges for 30+ services as RPM packages. A dnf update refreshes the ranges from the vendor’s authoritative source.

How It Works

A generator fetches ranges directly from vendor endpoints — for example cloudflare.com/ips, openai.com/gptbot.json, Google’s crawler ranges, and Stripe’s webhook list. Package versions derive from the upstream publication timestamp (e.g. firewalld-ipset-cloudflare-v4-20251215), and packages rebuild only when ranges actually change. A routine dnf update picks up new ranges within a day or two of publication.

Two Package Families

• firewalld-ipset-* — registers an ipset with FirewallD; post-install runs firewall-cmd --reload.
• nginx-iplist-* — ships three include files in /etc/nginx/iplist/; post-install runs nginx -t and reloads NGINX when active.

Both reload consumers automatically, so unattended dnf-automatic updates take effect immediately.

Platform Support

RHEL-based distributions — RHEL, AlmaLinux, Rocky Linux, Oracle Linux, and CentOS Stream — versions 8, 9, and 10, from the GetPageSpeed repository. Packages are architecture-independent (noarch), so x86_64 and ARM share the same packages. Debian and Ubuntu packages are not available yet.

Installation

sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm
sudo dnf -y install firewalld-ipset-cloudflare-v4 nginx-iplist-cloudflare-v4

Package naming is firewalld-ipset-<list> or nginx-iplist-<list>. Lists published separately for IPv4/IPv6 carry a -v4/-v6 suffix.

FirewallD Usage

Installing a firewalld-ipset-* package registers the ipset immediately — verify with firewall-cmd --get-ipsets. To whitelist system-wide, attach it to the trusted zone:

sudo firewall-cmd --permanent --zone=trusted --add-source=ipset:cloudflare-v4
sudo firewall-cmd --reload

Attaching to the drop zone instead blocks the service outright — the standard approach for unwanted AI crawlers.

NGINX Usage

Each package provides three access-control patterns:

• <list>.geo.conf — defines a geo block setting $is_<list> to 1 for matching IPs (hyphens become underscores). Include at http level. Tested on Rocky Linux 10 with NGINX 1.28: a local address yields cf=0, a Cloudflare address yields cf=1.
• <list>.allow.conf — plain allow directives; include in a location followed by deny all;. Tested: Stripe webhook address 3.18.12.63 gets HTTP 200, others get HTTP 403.
• <list>.nolimit.conf — bare geo entries mapping trusted CIDRs to an empty string, which limit_req treats as “don’t count.” The pattern uses a map to route trusted addresses to an empty $rate_limit_key. Burst test: an ordinary client gets 200 429 429 200 429 429; the Googlebot address 34.22.85.1 gets six consecutive 200s.

Gotcha

allow/deny run in NGINX’s access phase, but return runs earlier in the rewrite phase. A location containing only return answers before access control runs — always pair the allow variant with real content handling (proxy_pass, try_files, static files), never a bare return.

Raw CIDR Access

Every nginx-iplist-* package drops the raw list into /usr/share/trusted-lists/plain/<list>.txt, one CIDR per line, for downstream scripts and daemons.

fail2ban Integration

The fail2ban-trusted-lists-helper package exempts every installed trusted list from all jails at once. It wires a [DEFAULT] ignorecommand into /etc/fail2ban/jail.d/00-trusted-lists.local, pointing at a helper that matches candidate IPs against /usr/share/trusted-lists/plain/ using grepcidr. Requires EPEL:

sudo dnf -y install epel-release
sudo dnf -y install fail2ban-trusted-lists-helper

Verify with fail2ban-client get sshd ignorecommand. The helper script also works standalone:

/usr/share/trusted-lists/scripts/fail2ban-ignoreip-check 3.18.12.63 && echo trusted

Automation

Enable dnf-automatic so vendor range changes apply without intervention:

sudo dnf -y install dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer

Related Tooling

• fds (FirewallD Made Easy) for country and Tor blocking.
• An NGINX honeypot for automatic bot banning.
• GetPageSpeed Amplify for scheduled gixy scans tied to live NGINX runtime metrics, drop-in compatible with the deprecated nginx-amplify-agent (EOL January 2026).

Missing services can usually be packaged within a day on request.

Read the full article: Trusted IP Lists for FirewallD, NGINX and fail2ban