Threat feed

premium

OgmaProtect's own list of addresses known to attack routers, applied ahead of every rule you write.

This box's record of the threat feed could not be read

OgmaProtect cannot tell what state the threat feed is in on this box.

Nothing has been changed. The firewall keeps whatever the feed last applied. Reload this page in a minute; if it keeps happening, send support the box's diagnostics.

Your subscription is no longer active. This box is still blocking with the list it already holds. Renew at the portal, or turn the feed off.

Threat feed: no updates since this box started, {{AGE_TEXT}} ago; the clock is not yet trusted. Still blocking with {{COUNT_SAVED}} addresses.

Threat feed: no updates in {{AGE_TEXT}}. Still blocking with {{COUNT_SAVED}} addresses.

Threat feed: the list's age is not known yet.

Check the connection

The last update would have blocked more of the internet than any feed should. It was refused; this box is still blocking with the list it already held. If this persists, contact OgmaProtect.

What it blocks

Addresses that are attacking routers right now — scanners, brute-force sources and the hosts behind them.
Known command-and-control addresses, so a machine inside your network cannot reach the people running it.
Both directions, ahead of every firewall rule you have written, with your own management addresses never blocked.

This box

The threat feed needs about {{NEED_MB}} MB of free memory and room in the firewall for two copies of its list — about 1,000,000 table entries at the largest list the service sends ({{MAX_PREFIXES}} addresses). It also needs the structured firewall rules, at least one declared management source, and an IPv4 address on the internet-facing interface.

OgmaProtect checks all of that on this box when you turn the feed on, and stops with a plain explanation if anything is missing. Nothing is changed until every check passes.

What leaves this box if you enable it

{{E_HEADING}}: {{E_BODY}}

The last time it was on

Enabling needs an administrator

You can see what the threat feed does and what it would send, but turning it on changes this box's identity with OgmaProtect. Ask an administrator to enable it.

Turn the threat feed on

Activation key I have read what leaves this box, above: the activation key, this box's tunnel public key and this release series go to OgmaProtect when you turn it on, this box makes that call again by itself with a token in place of the key only if its tunnel has to move, and OgmaProtect's concentrator sees this box's public internet address for as long as the feed is on. {{#PEER_TICK}} You are connecting from {{PEER_ADDR}}, which is not a declared management source. Tick to add it to the never-block list so the feed can never block you. The entry does not expire: remove it from the list when you no longer need it. If you leave the box above unticked, tick this one instead: I understand this address can be blocked. If it is ever on a list set to Block, the threat feed will cut this session and block this box's web and SSH ports from it, and only a declared management source or the console will reach the box. {{/PEER_TICK}} {{#PEER_WARN}}

You are connecting from {{PEER_ADDR}}, which is not a declared management source. Adding it to the never-block list needs firewall write access, which this account does not have. To be safe, declare a management source on the Firewall page, or have someone with firewall write access add this address to the never-block list, before the feed is turned on.

I understand this address can be blocked. If it is ever on a list set to Block, the threat feed will cut this session and block this box's web and SSH ports from it, and only a declared management source or the console will reach the box. {{/PEER_WARN}}

Turning the threat feed on

OgmaProtect does this, in order:

{{S_TEXT}} ✓ done

{{#FITS}}{{#F_OK}}fits{{/F_OK}}{{^F_OK}}does not fit{{/F_OK}} {{F_TEXT}}{{/FITS}}

This is running now. It can take a couple of minutes.

This box stopped part-way through turning the feed on, and nothing is running now.

Ask an administrator to finish it.

What it has caught

Get an email the moment a device inside reaches a listed address: add an email or webhook channel under Logs, Alerts. The threat feed's outbound alert is already switched on; it only needs somewhere to send it.

Latest

When (UTC)	What happened	Category	Routing domain
{{W_WHEN}}	{{#W_OUT}}{{W_INSIDE}}{{#W_DEVICE}} ({{W_DEVICE}}){{/W_DEVICE}} reached {{W_LISTED}}{{/W_OUT}}{{^W_OUT}}{{W_LISTED}} reached {{W_INSIDE}}{{#W_DEVICE}} ({{W_DEVICE}}){{/W_DEVICE}}{{/W_OUT}} · {{W_PROTO}}{{#W_COUNT}} · {{W_COUNT}} times in that minute{{/W_COUNT}} · {{#W_BLOCKED}}blocked{{/W_BLOCKED}}{{^W_BLOCKED}}logged only{{/W_BLOCKED}} · why?	{{W_CAT}}{{#W_HAS_META}} {{#W_FAMILY}}{{W_FAMILY}}{{/W_FAMILY}}{{#W_CONF}}{{#W_CONF_SEP}} · {{/W_CONF_SEP}}confidence {{W_CONF}} of 5{{/W_CONF}}{{#W_SEEN}}{{#W_SEEN_SEP}} · {{/W_SEEN_SEP}}first seen {{W_SEEN}}{{/W_SEEN}}{{#W_REF}}{{#W_REF_SEP}} · {{/W_REF_SEP}}reference {{W_REF}}{{/W_REF}} {{/W_HAS_META}}	{{W_RD}}

{{LATEST_EMPTY}} A box with a public address is usually scanned within minutes; the first block appears here when it happens.

Sync

{{#HAS_TOTAL}}{{COUNT_LIVE}} of {{MARKER_TOTAL}} addresses ({{SYNC_PCT}}%){{/HAS_TOTAL}}

Listed now: {{COUNT_LIVE}} addresses
Saved copy: {{COUNT_SAVED}} addresses
Never blocked: {{COUNT_ALLOW}} addresses
Last update: {{#AGE_KNOWN}}{{AGE_TEXT}} ago{{/AGE_KNOWN}}{{^AGE_KNOWN}}The list's age is not known yet.{{/AGE_KNOWN}}
Feed session: {{SESSION}}
Tunnel handshake: {{TUNNEL_HANDSHAKE}} ago
Tunnel handshake: This box has not heard from OgmaProtect yet.
Tunnel traffic: {{TUNNEL_RX}} in / {{TUNNEL_TX}} out
This box: {{DEVICE}}
Re-home: {{REHOME_TEXT}}

Category	Action	Listed now	Blocked today	Saved copy
{{C_LABEL}}{{#C_CUSTOM}} changed{{/C_CUSTOM}}{{#C_NEW}} new{{/C_NEW}}{{#C_RESET}} revised{{/C_RESET}} {{C_DESC}} {{#C_RESET}} OgmaProtect changed what this category means (revision {{C_REV}}), so any earlier choice for it was reset: it now follows OgmaProtect's default. {{/C_RESET}}{{#C_HAS_LINK}} More about this category {{/C_HAS_LINK}}	Action for {{C_LABEL}}	{{C_LIVE}}	{{C_TODAY}}	{{C_SAVED}}
Uncategorised {{UNC_DESC}}	Log only	{{UNC_LIVE}}	{{UNC_TODAY}}	{{UNC_SAVED}}

Category	Action	Listed now	Blocked today	Saved copy
{{C_LABEL}}{{#C_CUSTOM}} changed{{/C_CUSTOM}}{{#C_NEW}} new{{/C_NEW}}{{#C_RESET}} revised{{/C_RESET}} {{C_DESC}} {{#C_RESET}} OgmaProtect changed what this category means (revision {{C_REV}}), so any earlier choice for it was reset: it now follows OgmaProtect's default. {{/C_RESET}}{{#C_HAS_LINK}} More about this category {{/C_HAS_LINK}}	{{C_ACTION_TEXT}}	{{C_LIVE}}	{{C_TODAY}}	{{C_SAVED}}
Uncategorised {{UNC_DESC}}	Log only	{{UNC_LIVE}}	{{UNC_TODAY}}	{{UNC_SAVED}}

Never block

Addresses the threat feed must never block, whatever OgmaProtect sends. Your own entries come first; underneath is the set this box works out for itself.

Address or network	Expires	Note	Remove
{{A_ENTRY}}{{#A_EXPIRED}} expired{{/A_EXPIRED}}	{{A_EXPIRES}}	{{A_NOTE}}	{{#CAN_PF_WRITE}} {{/CAN_PF_WRITE}}

You have not added any addresses of your own.

OgmaProtect could not read this box's firewall configuration just now, so your own never-block entries are not shown. Nothing has been changed. Reload this page in a minute.

Worked out by this box

Your declared management addresses, every network this box is connected to, its gateways and OgmaProtect's own tunnel. These are always exempt and cannot be edited.

{{X_ENTRY}}

This list is longer than the page shows.

Why is this blocked?

Type an address to find out whether the threat feed is blocking it, and why.

The threat feed is not running on this box, so it is blocking nothing.

{{LOOKUP_ADDR}} is on OgmaProtect's list under {{LOOKUP_LABEL}}{{#LOOKUP_HAS_GENERATION}}, in the address list numbered {{LOOKUP_GENERATION}}{{/LOOKUP_HAS_GENERATION}}{{#LOOKUP_SAVED}} — in the saved copy this box is still blocking with, not in the list arriving now{{/LOOKUP_SAVED}}. {{LOOKUP_ACTION_TEXT}}

What OgmaProtect says about it: {{#LOOKUP_FAMILY}}{{LOOKUP_FAMILY}}{{/LOOKUP_FAMILY}}{{#LOOKUP_CONF}}{{#LOOKUP_CONF_SEP}} · {{/LOOKUP_CONF_SEP}}confidence {{LOOKUP_CONF}} of 5{{/LOOKUP_CONF}}{{#LOOKUP_SEEN}}{{#LOOKUP_SEEN_SEP}} · {{/LOOKUP_SEEN_SEP}}first seen {{LOOKUP_SEEN}}{{/LOOKUP_SEEN}}{{#LOOKUP_REF}}{{#LOOKUP_REF_SEP}} · {{/LOOKUP_REF_SEP}}reference {{LOOKUP_REF}}{{/LOOKUP_REF}}.

No details from OgmaProtect are shown for this listing. They reach this box once a day, so a listing that is new or has changed since then has none here yet.

Report a mistake opens OgmaProtect's portal in a new tab with this address filled in. Like each category's More about this category, it is a link to OgmaProtect that your browser follows when you press it: this box sends nothing.

{{LOOKUP_ADDR}} is not on OgmaProtect's list. If something cannot reach it, the reason is one of your own firewall rules.

{{LOOKUP_ADDR}} is on the never-block list, so the threat feed will never block it whatever OgmaProtect sends.

{{LOOKUP_ADDR}} is one of this box's own addresses, which the threat feed never blocks.

What leaves this box

{{L_HEADING}}

What each of those is

{{E_HEADING}}: {{E_BODY}}

Turn the threat feed off

This box stops using the threat feed and stops being enrolled.

Turning the threat feed off removes all of this:

the tunnel to OgmaProtect and this box's enrolment
the address lists this box is blocking with, and their saved copy
the feed's firewall rules
the per-category settings

Your own firewall rules, your never-block list and everything else you have configured stay exactly as they are. You can turn the feed back on later with a new activation key.