Block TOR IPs using CSF csf.blocklists

[itcms]

If you have observe there are lists under csf.blocklists which not working
cat /etc/csf/csf.blocklists
Example TOR Exit Nodes List

If you want to block extra TOR ip , avoiding attacks then edit /etc/csf/csf.blocklists and add
TOR3|86400|0|https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-nodes.lst

Finally text :
# TOR Exit Nodes List
# Set URLGET in csf.conf to use LWP as this list uses an SSL connection
# Details: https://trac.torproject.org/projects/tor/wiki/doc/TorDNSExitList
#TOR|86400|0|https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.2.3.4 <-- THIS IS THE DEFAULT NOT WORKING
TOR3|86400|0|https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-nodes.lst

Save and restart csf
csf -r

 

[Richard G]

I get a blank page on that github link. When I limit it to Tor-IP-Addresses it gives a 400 Invalid request as return.
Seems you forgot the /blob in your link.

This is the correct url:
https://github.com/SecOps-Institute/Tor-IP-Addresses/blob/master/tor-exit-nodes.lst

 

[Richard G]

#TOR|86400|0|https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.2.3.4 <-- THIS IS THE DEFAULT NOT WORKING

Why not? If i click that link I get a complete list of TOR ip's. You do need to set URLGET to LWP (so 2) in csf.conf.