HAProxy

HAProxy can match the client address against a file of addresses with an ACL. Keep the file in sync with the blocklist and deny matches in your frontend.

Set it up

1. Download the list hourly from cron, and reload HAProxy only when it changed:

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt&confidenceMinimum=90" -o /etc/haproxy/isipsafe.lst.new \
     && ! cmp -s /etc/haproxy/isipsafe.lst.new /etc/haproxy/isipsafe.lst \
     && mv /etc/haproxy/isipsafe.lst.new /etc/haproxy/isipsafe.lst && systemctl reload haproxy

2. Deny listed clients in your HTTP frontend:

   frontend web
       bind :443 ssl crt /etc/haproxy/certs/
       acl isipsafe_listed src -f /etc/haproxy/isipsafe.lst
       http-request deny deny_status 403 if isipsafe_listed
       default_backend app

   For TCP frontends (SMTP, databases, anything that is not HTTP), reject before any data is read:

       tcp-request connection reject if { src -f /etc/haproxy/isipsafe.lst }

Behind Cloudflare or another proxy

When HAProxy sits behind a CDN, src is the CDN. Match the forwarded address instead, and only trust that header from the CDN's ranges:

    acl from_cloudflare src -f /etc/haproxy/cloudflare-ips.lst
    acl isipsafe_listed req.hdr_ip(CF-Connecting-IP) -f /etc/haproxy/isipsafe.lst
    http-request deny deny_status 403 if from_cloudflare isipsafe_listed

Or block at the edge with the Cloudflare integration.

Need a hand?

If something here does not work with your version of HAProxy, or you have improved it, tell us. We update these pages with what people send.

HAProxy and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.