log2table is a small daemon I wrote: it watches log files, recognizes attack patterns with regular expressions, and puts the offending IP addresses in a PF table so the firewall blocks them. The whole behavior is driven by one file: parameters.py.

Writing rules is easy. Knowing whether they are good rules is harder: do they catch what is really hitting my server today? Do they ban innocent visitors? Do two rules count the same attack twice?

This post explains the new version of parameters.py in the repository, its built-in checker that runs against your real log files, and how I used an AI (Claude, through Claude Code) to read the checker's output and propose improvements.

As for each server on internet, I receive lot of bad requests. Thanks to a continuous check on different log files, I'm able to automatically add bad IPs in the pf firewall (OpenBSD). This blog will explain how I've setup log2table and how I treat those bad IPs

Log2table allows you to continuously monitor your logfiles. You can trigger actions when a specific message comes in your audited logfiles or when a specific number of occurrences are present.

Those days, when you fire-up a new machine, it takes few hours that bad persons are trying to connect to your machine via ssh, try default URL with default passwords, ...

This post will explain how OpenBSD can easily helps you to ban those persons out of your machine for quite a long time.