S
Sprint Log Parser
Log in Get Started
Docs / Edge Hardening / Local Firewall Scripts

Local Firewall Scripts

Automate real-time host protection using Nginx Intrusion Prevention rules or Linux kernel-level iptables chains directly on your origin servers.

1. Automated Nginx IP Blocking (IPS)

How It Works & What It Does

Deploy an automated Intrusion Prevention System (IPS) by syncing Sprint Log Parser's real-time malicious IP blocklist directly with your Nginx web server. When log analysis flags an attacker IP, it is instantly added to your project's dynamic API blocklist endpoint: 

https://sprint-logparser.dev.5starcompany.com.ng/api/projects/YOUR_API_TOKEN/blocklist

This endpoint returns Nginx-formatted configuration directives (`deny ;`) listing all flagged threat hosts for your project workspace.

Key Benefits

  • Web Server Layer Shielding: Drops requests at the Nginx layer before they hit application code or database backends.
  • Zero Root Agent Required: Does not require root access or custom kernel modules on your server.
  • Safe & Reloadable: Uses standard `systemctl reload nginx` commands without severing active client connections.

What You Need to Run on Your Server

  1. Include the synced blocklist file inside your main Nginx configuration block (usually inside `/etc/nginx/nginx.conf` or your server block `/etc/nginx/sites-enabled/*`): 
    include /etc/nginx/blocklist.conf;
  2. Set up a cron job on your server to query the API endpoint hourly and reload Nginx safely: 
    0 * * * * curl -sS "https://sprint-logparser.dev.5starcompany.com.ng/api/projects/YOUR_API_TOKEN/blocklist" > /etc/nginx/blocklist.conf && systemctl reload nginx

2. Automated Linux Firewall IP Blocking (iptables Chain)

How It Works & What It Does

Drop traffic at the Linux network kernel layer using a dedicated `MEGASPRINT_BLOCKLIST` iptables chain. The sync script queries your project's raw IP blocklist endpoint (`/api/projects/YOUR_API_TOKEN/raw-ips`) and syncs kernel packet filter rules automatically.

Key Benefits

  • Silences Repeat Security Alerts: Because blocked IPs are dropped at the packet layer, Nginx never receives the request and never writes access log entries, eliminating log bloat.
  • Conserves System Memory & CPU: Prevents TCP socket creation and SSL handshakes for blacklisted threat hosts entirely.
  • Universal Linux Support: Operates natively on any Linux distribution regardless of whether UFW or other wrappers are active.

What You Need to Run on Your Server

  1. Download and install the pre-configured firewall synchronization script on your server using a single command: 
    sudo curl -sSf "https://sprint-logparser.dev.5starcompany.com.ng/download/sync-script?token=YOUR_API_TOKEN" -o /usr/local/bin/sync-blocklist.sh && sudo chmod +x /usr/local/bin/sync-blocklist.sh
  2. Configure a root cron job (using `sudo crontab -e`) to execute the sync script every 30 seconds: 
    * * * * * /usr/local/bin/sync-blocklist.sh >/dev/null 2>&1
* * * * * sleep 30 && /usr/local/bin/sync-blocklist.sh >/dev/null 2>&1

3. Whitelisting & Exclusions

To prevent accidental lockouts of internal infrastructure, trusted IPs and CIDR blocks (such as administrator IPs, office gateways, or health check probes) can be managed under your **Workspace Whitelist**.

Whitelisted addresses are excluded from all automated Nginx IPS blocklists and iptables chain drops across all server nodes.