1.\" $NetBSD: blocklistd.conf.5,v 1.9 2026/01/13 21:38:18 christos Exp $ 2.\" 3.\" Copyright (c) 2015, 2025 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Christos Zoulas. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 19.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28.\" POSSIBILITY OF SUCH DAMAGE. 29.\" 30.Dd January 13, 2026 31.Dt BLOCKLISTD.CONF 5 32.Os 33.Sh NAME 34.Nm blocklistd.conf 35.Nd configuration file format for blocklistd 36.Sh DESCRIPTION 37The 38.Nm 39file contains configuration entries for 40.Xr blocklistd 8 41in a fashion similar to 42.Xr inetd.conf 5 . 43Only one entry per line is permitted. 44Every entry must have all fields populated. 45Each field can be separated by a tab or a space. 46Comments are denoted by a 47.Dq # 48at the beginning of a line. 49.Pp 50There are two kinds of configuration lines, 51.Va [local] 52and 53.Va [remote] . 54By default, configuration lines are 55.Va [local] , 56i.e. the address specified refers to the addresses on the local machine. 57To switch to between 58.Va [local] 59and 60.Va [remote] 61configuration lines you can specify the stanzas: 62.Dq [local] 63and 64.Dq [remote] . 65.Pp 66On 67.Va [local] 68and 69.Va [remote] 70lines 71.Dq * 72means use the default, or wildcard match. 73In addition, for 74.Va [remote] 75lines 76.Dq = 77means use the values from the matched 78.Va [local] 79configuration line. 80.Pp 81The first four fields, 82.Va location , 83.Va type , 84.Va proto , 85and 86.Va owner 87are used to match the 88.Va [local] 89or 90.Va [remote] 91addresses, whereas the last 3 fields 92.Va name , 93.Va nfail , 94and 95.Va disable 96are used to modify the filtering action. 97.Pp 98The first field denotes the 99.Va location 100as an address, mask, and port. 101The syntax for the 102.Va location 103is: 104.Bd -literal -offset indent 105 [<address>|<interface>[/<mask>]:]<port> 106.Ed 107.Pp 108The 109.Dv address 110can be an IPv4 address in numeric format, an IPv6 address 111in numeric format and enclosed by square brackets, or an interface name. 112Mask modifiers are not allowed on interfaces because interfaces 113can have multiple addresses in different protocols where the mask has a 114different size. 115.Pp 116The 117.Dv mask 118is always numeric, but the 119.Dv port 120can be either numeric or symbolic. 121.Pp 122The second field is the socket 123.Va type : 124.Dv stream , 125.Dv dgram , 126or numeric. 127The third field is the 128.Va protocol : 129.Dv tcp , 130.Dv udp , 131.Dv tcp6 , 132.Dv udp6 , 133or numeric. 134The fourth field is the effective user 135.Va ( owner ) 136of the daemon process reporting the event, 137either as a username or a userid. 138.Pp 139The rest of the fields control the behavior of the filter. 140.Pp 141The 142.Va name 143field, is the name of the packet filter rule to be used. 144If the 145.Va name 146starts with a hyphen 147.Pq Dq - , 148then the default rulename is prepended to the given name. 149If the 150.Dv name 151contains a 152.Dq / , 153the remaining portion of the name is interpreted as the mask to be 154applied to the address specified in the rule, causing a single rule violation to 155block the entire subnet for the configured prefix. 156.Pp 157The 158.Va nfail 159field contains the number of failed attempts before access is blocked, 160defaulting to 161.Dq * 162meaning never, and the last field 163.Va duration 164specifies the amount of time since the last access that the blocking 165rule should be active, defaulting to 166.Dq * 167meaning forever. 168The default unit for 169.Va duration 170is seconds, but one can specify suffixes for different units, such as 171.Dq m 172for minutes 173.Dq h 174for hours and 175.Dq d 176for days. 177.Pp 178Matching is done first by checking the 179.Va [local] 180rules individually, in the order of the most specific to the least specific. 181If a match is found, then the matching 182.Va [remote] 183rules are applied. 184The 185.Va name , 186.Va nfail , 187and 188.Va duration 189fields can be altered by the 190.Va [remote] 191rule that matched. 192.Pp 193The 194.Va [remote] 195rules can be used for allowing specific addresses, changing the mask 196size (via 197.Va name ) , 198the rule that the packet filter uses (also via 199.Va name ) , 200the number of failed attempts (via 201.Va nfail ) , 202or the duration to block (via 203.Va duration ) . 204.Sh FILES 205.Bl -tag -width /etc/blocklistd.conf -compact 206.It Pa /etc/blocklistd.conf 207Configuration file. 208.El 209.Sh EXAMPLES 210.Bd -literal -offset 8n 211# Block ssh, after 3 attempts for 6 hours on the bnx0 interface 212[local] 213# location type proto owner name nfail duration 214bnx0:ssh * * * * 3 6h 215[remote] 216# Never block 1.2.3.4 2171.2.3.4:ssh * * * * * * 218# Never block the example IPv6 subnet either 219[2001:db8::]/32:ssh * * * * * * 220# For addresses coming from 8.8.0.0/16 block whole /24 networks instead 221# individual hosts, but keep the rest of the blocking parameters the same. 2228.8.0.0/16:ssh * * * /24 = = 223.Ed 224.Sh SEE ALSO 225.Xr blocklistctl 8 , 226.Xr blocklistd 8 227.Sh HISTORY 228.Nm 229first appeared in 230.Nx 7 . 231.Fx 232support for 233.Nm 234was implemented in 235.Fx 11 . 236.Sh AUTHORS 237.An Christos Zoulas 238