ThreatSTOP - Active Internet Security - How Can I use ThreatSTOP? FAQ

Partners

How Can I use ThreatSTOP? FAQ

What you need to know up front.
- ThreatSTOP can be used by any device that can use a forward DNS (standard) lookup in a rule. There is no special software or hardware required.
- ThreatSTOP requires a fully RFC-compliant resolver, since the longer lists require TCP queries to propagate. The longer lists are broken into multiple lookups of 4000 hosts each, so in order to fully use ThreatSTOP, your system needs to be able to handle lookups of up to 4000 IPs per FQDN. Any resolver based on recent and current GNU, ISC or BSD resolver libraries has this capabilitiy.
- Threatstop is a pull, not a push, service. We make the DNS lookups available, but you have to resolve them and load them into your device. Many devices do this completely automatically, based on the TTL of the DNS lookup, some need to be told to flush and reload DNS periodically, others require a script and a cron job.
- We secure our DNS infrastructure using ACLs that only allow configured devices to access our nameservers, and devices configured in an SMB or Enterprise user's account to access their lists. As a result, we need to know the IP address that the queries will be coming from. This is statically configured and is a limitation of the current BIND. If you have a dynamic address, you will need to periodically update your configured IP address.
- You will need enough memory to load the lists you select. Currently, the basic list is about 15,000 IP addresses. You should allow at least 64K bytes for that many addresses, and keep in mind that your firewall will be comparing each connection attempt with these 15,000 addresses. While this may sound like a lot, a modern CPU can do a 32 bit compare in about 2 clock cycles, so the performance hit for all but the oldest, or most heavily loaded, firewalls should be negligible. If you are getting hit a lot by actors in the lists, it may well reduce load, by dropping the attackers @ the first SYN, as opposed to requiring content inspection or a traditional RBL connection accept, lookup, 500 response block.
Subscribe
To use ThreatSTOP, you first have to subscribe to the service. The basic service is free. When you Sign Up, you create an account using your e- mail address as your userid, and a strong password. Then you configure the devices that you want to use the threat feeds. We need to know the IP address that the devices will be querying our DNS servers from, because we limit access to our DNS servers to subscribed devices, and for SMB and Enterprise users, limit access to their lists only to their devices.
Configure Devices on ThreatSTOP
You need to enter the IP addresses of the devices that will be using the service, and if you are a SMB or Enterprise subscriber, you will need to select your feeds and configure any custom allow or deny lists.
Configure your firewall
When you configure a device, you will be given the custom instructions for that firewall, to help you use the service. The basic steps consist of:
1. Making your firewall resolve the threatstop.local domain using our nameservers. The easiest way to do this is make our nameserver primary for your firewall. We will do recursive queries for you.
2. Configure your rules to use the lookups, specifying the action you want to take. This is covered in more detail in the help section of our UI.
3. Make any configuration changes or cron jobs necessary to have your device reload the lists every two hours, if your device doesn't reload on TTL expiration.
4. Configure your firewall(s) to send us your logs.
Submit your logs
The easiest way to do this is via e-mail, using the automatic feature of your firewall or a cron job, to <ip-address-of-your- firewall>@logs.threatstop.com. However, if that doesn't work, you can always submit using the web interface.
We use the logs to develop additional, more timely, threat feeds, and show you what lists the IPs blocked by your firewall came from.

[ Back ]

Main Menu