At the moment the block list only lives in memory, but that is definitely on the roadmap! We’re working on a couple of other features at the moment (namely support for stateful rules and the ability to download and use crowd sourced block lists of known malicious IPs). Our plan is to use Postgres both for persisting blocklist state and for replicating the blocklist across nodes when native clustering is not an option. In other words…coming soon!

That looks great!

Is the requests data and blocked IPs stored somewhere, or just in memory? I’m asking because I use Heroku and they reset the dynos daily, will the blocked IPs be wiped out in this case?

0.2.1 release announcement

@PJUllrich and I have been fairly busy with Phx2Ban since its initial release and we’ve gone though and added a bunch of features that were requested by users!

The biggest announcement in these last couple releases is the ability to pull down a serialized Cuckoo filter from ezsuite.dev that has IP addresses from the public block list https://www.abuseipdb.com/.

We have some other very cool features in the works so stay tuned!

Here is the full changelog from the last two releases with the latest version being 0.2.1:

[0.2.1] - 2024-11-29

Fixed

• Fixes a FunctionClauseError in the KnownMaliciousIP rule when an IPv6 address was checked.
• Bumped the dependency phoenix_live_dashboard to at least 0.8.0 because versions below that were missing some functions we use in the LiveDashboardPlugin and that lead to compilation errors. (See #2)

[0.2.0] - 2024-11-28

Added

• New Rule KnownMaliciousIP. Fetches a public blocklist of ~85k known malicious IPs tracked by AbuseIPDB from ezsuite.dev and blocks requests originating from these IPs.
• Phx2Ban.manually_block_ip_address/1 function will manually add an IP address to the block list..
• Phx2Ban.ip_address_status/1 function will return the current status of an IP address.
• Config option allow_list. Accepts a list of IP addresses as strings so that you can avoid analyzing/blocking traffic from certain trusted IP addresses.
• Config option enabled for enabling/disabling the firewall. Can be triggered through the LiveDashboard plugin or manually through Phx2Ban.FirewallConfig.put!(:enabled, true|false).
• Config option ignore_routes. Accepts a list of routes as string or regex that Phx2ban should ignore. Any requests to these routes are excluded from analysis and will never get blocked.