IP Blocklist to Cisco ASA access-list VBscript

**This article is old, see new Blocklist2ACL 2.0 project.**


Hi folks! A little script I wrote with VBscript that pulls in IP blocklists from different third party URLs and converts them in to well-formatted Cisco ASA access-lists.  The idea stemed from the old days of running PeerGuardian and Moblock to inhibit known malicious or unwanted IP address from attempting to connect and stopping them right then and there on your computer’s firewall. It is similar to URL Blocklists that focus on URLs and Domain Names, but instead filering is done by IPs only. I wanted to take this IP Blocklist concept that has primarly been done at the Desktop Fireweall layer and abstract it to the Network Firewall. In this case a Cisco ASA that way all traffic that any connection that crosses the Firewall will be filtered by this list.

The script is fairly straightforward and the source code is below so you may look through it. Feel free to improve upon it and share it with others. I have a few years of writing vbscripts, but am in no way a professional coder. Also, if you by any chance know Linux Shell or Qt and could potentially port this to Linux or even better JAVA for platform independence, let me know!! That would be sweet.

Video Tutorial

Screenshot


The Blocklists

Each blocklist is sourced by a third party maintainer, and distributed by them. I take no responsibilities for their content or any ownership of the content. Please review their usage terms.

Some blocklists require conversion from their native format to CIDR format for easy processing into the access-list format. To accomplish this, my script utilizes a web based Form hosted by Bluetrack, located here.(http://www.bluetack.co.uk/converter/).

Another shout out is to the writer of the following scripts on CDIR and subnet conversion, located here (http://www.indented.co.uk/2008/10/21/vbscript-subnet-math/) THANK YOU!!

GZIP Requirement

Lastly, you will need gzip.exe to un-gzip some of the blocklists that are downloaded as gzipped files. Luckly gzip is a GNU Free Software Foundation and can be downloaded via http://gnuwin32.sourceforge.net/packages/gzip.htm. Click on the Binaries ZIP link to download it from SourceForge. Look for the gzip.exe executable in the bin folder of the ZIP file. Copy this into the same directory as the HTA file.
ACLfolder

Source Code: Blocklist2ACL-v3.hta

Sources:

There are 14 comments left Go To Comment

  1. Steve C /

    Kudos! This is an excellent tool. Something I’ve been looking at doing for YEARS, but far too lazy to do. I’ve used/Frankensteined other peoples scripts, etc for nearly 20 years, but this was the first time I felt compelled to comment/complement them. Good job and thanks!!!

    1. Jim / Post Author

      Thank you for the kind words Steve. I hope the tool comes in handy!

  2. Aaron /

    This looks like a very handy tool that will save me a lot of extra work , so I thank you. When I run the script I am getting a script error. It is saying Line 53 char 4 access denied.

  3. Aaron /

    The app was being blocked on my system and once that was cleared the script error stopped occurring. Any chance you could make a second version that would be supported on a router using the reverse mask? We do not have any ASA firewalls but this would be handy on a couple of our edge routers.

    1. Jim / Post Author

      I’ve added new code with a Wildcard Notation checkbox. Let me know if it works for you. Thanks
      https://www.dropbox.com/s/samyplr4wp5ee9l/Blocklist2ACL-v2.hta?dl=0

  4. Adesh /

    hello ,
    I have a cisco switch , I really want to implement ur work but is this easier or the same thing ?

    http://jebaird.com/2012/12/21/hosts-to-ip-host-generating-blocked-hosts-from-a-host-file-for-a-cisco-router.html

    1. Jim / Post Author

      I would recommend doing this on something like a Firewall or an ASR. You run into hardware limitations on the list size. With an ASA you have the option of more RAM. Good luck!

  5. Gerry /

    THis looks really nice. I tried to download the script, but it is no longer available on dropbox. Do you have another link available for download? I tried copying the source into a file named the same thins, but that didn’t work.

    1. Gerry /

      When I double click on the .hta file it opens up to display the code

      1. thejimmahknows / Post Author
        1. Gerry /

          That link worked, thanks Jim!

  6. Gerry /

    Jim,

    Whenever I select Dsheild, I get:
    error: line 147, Char 4, Object required: ‘obje.Document.Getelementbyid(..)’,Code: 0,

    1. thejimmahknows / Post Author

      Hey Gerry, seeing how many people were having issues with Internet Explorer compatiblity, I went ahead and ported the entire project over to Java. All you need is JRE 1.7+ and you can get it from the post I just published. I hope this works for you. Cheers!

  7. Pingback: Blocklist2ACL 2.0 Released!! | thejimmahknows /

Leave a Reply