ipban.config

<?xml version="1.0"?>

<configuration>

	<!--
		Please see full configuration documentation:
		- https://github.com/DigitalRuby/IPBan/wiki/Configuration
		- https://github.com/DigitalRuby/IPBan/wiki/Regex
    -->

	<!-- A collection of log files to parse, these are polled periodically based on PingInterval for each log file -->
	<LogFilesToParse>
		<LogFiles>

			<!-- SSH failed logins, Ubuntu -->
			<LogFile>

				<!-- The file source (i.e. SSH, SMTP, etc.) -->
				<Source>SSH</Source>

				<!--
					The folder and mask to watch for log files to parse - one entry per line
					Special place-holders are {year}, {month} and {day}, i.e. log-{year}-{month}-{day}
					This would turn into log-2019-05-08, always zero padded to 2 digits for month and day
					You can use year-local, month-local and day-local to use local time instead of UTC time.
					This is a glob pattern, you can use ** for recursive searching, i.e. /var/log/**/*.log
					would search the /var/log folder recursively for *.log files
				-->
				<PathAndMask>
					/var/log/auth*.log
					/var/log/secure*
					/var/log/messages
				</PathAndMask>

				<!--
					Regex for each file line to parse out the user name and ip address
					It is recommended to use \s for leading and trailing spaces for the regex as those are trimmed internally at the ends of the text
					Source can be overriden using a group that maches. Name the group source_sourcename.
					Example: (?<source_sshcustom>failed login for ssh, ip: (?<ipaddress>[^,]+), port: [0-9]+)
				-->
				<!--
					Example lines
					Feb 21 08:35:22 localhost sshd[5774]: Failed password for root from 116.31.116.24 port 29160 ssh2
					Jul  3 12:52:21 vps192513 sshd[16201]: Connection closed by 150.95.154.204 port 56032 [preauth] (no attempt to login after timeout)
				-->
				<FailedLoginRegex>
					<![CDATA[
						(?<log>failed\s+password)\s+for\s+(?:invalid\s+user\s+)?(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+ssh|
						(?<log>did\s+not\s+receive\s+identification\s+string)\s+from\s+(?<ipaddress>[^\s]+)|
						(?<log>connection\s+(?:closed|reset))\s+by\s+(?:(?:(?:invalid|authenticating)\s+user\s+)?(?<username>[^\s]+)\s+)?(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
						(?<log>disconnected\s+from)\s+(?:invalid\s+user\s+)?(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
						(?<log>disconnected\s+from)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
						(?<log>disconnected\s+from\s+authenticating\s+user)\s+(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
						^(?<timestamp>\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2})\s+\S+\s+sshd\[\d+\]:.*?(?<log>invalid|illegal)\s+user\s+(?<username>\S+)\s+from\s+(?<ipaddress>[^\s]+)[^\n]+\n
					]]>
				</FailedLoginRegex>

				<!-- Optional, set a log level for failed logins - must match exactly (case sensitive) one of the following:
					Trace, Debug, Info, Warn, Error, Critical
					<FailedLoginLogLevel>Warn</FailedLoginLogLevel>		
				-->
				
				<!-- Optional, override minimum time between failed login attempts
					<MinimumTimeBetweenFailedLoginAttempts>00:00:00:00</MinimumTimeBetweenFailedLoginAttempts>
				-->

				<!-- For a SuccessfulLoginRegex, this will be a successful login and handled differently (IPBAN PRO only) -->
				<SuccessfulLoginRegex>
					<![CDATA[
						\s+Accepted\s+(?:password|publickey)\s+for\s+(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+ssh
					]]>
				</SuccessfulLoginRegex>

				<!-- Optional, set a log level for successful logins - must match exactly (case sensitive) one of the following:
					Trace, Debug, Info, Warn, Error, Critical
					<SuccessfulLoginLogLevel>Warn</SuccessfulLoginLogLevel>		
				-->

				<!-- Specify specific platforms here or . for all platforms (not recommended) - use Linux, MAC or Windows or Ubuntu, etc. -->
				<PlatformRegex>Linux</PlatformRegex>

				<!-- How often to parse and check for new files, etc. - in milliseconds -->
				<PingInterval>10000</PingInterval>

				<!-- 16 MB max size before deleting files and starting over -->
				<MaxFileSize>16777216</MaxFileSize>

				<!-- Override failed login threshold or leave 0 for default -->
				<FailedLoginThreshold>0</FailedLoginThreshold>

			</LogFile>

			<!--
				Custom log entries, Linux
				For custom logs, write this type of line and ipban will add a failed login:
				2020-01-01T01:01:01Z, ipban failed login: 10.10.10.10, source: ApplicationName, user: FailedUserName
			-->
			<LogFile>

				<Source>IPBanCustom</Source>
				<PathAndMask>/var/log/ipbancustom*.log</PathAndMask>
				<FailedLoginRegex>
					<![CDATA[
						(?<timestamp>\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d(?:\.\d+)?Z?)?(?:,\s)?(?<log>ipban\sfailed\slogin),\sip\saddress:\s(?<ipaddress>[^,\n]+),\ssource:\s(?<source>[^,\n]+)?,\suser:\s(?<username>[^\s,]+)?
					]]>
				</FailedLoginRegex>
				<SuccessfulLoginRegex>
					<![CDATA[
						(?<timestamp>\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d(?:\.\d+)?Z?)?(?:,\s)?ipban\ssuccess\slogin,\sip\saddress:\s(?<ipaddress>[^,\n]+),\ssource:\s(?<source>[^,\n]+)?,\suser:\s(?<username>[^\s,]+)?
					]]>
				</SuccessfulLoginRegex>
				<PlatformRegex>Linux</PlatformRegex>
				<PingInterval>10000</PingInterval>
				<MaxFileSize>16777216</MaxFileSize>
				<FailedLoginThreshold>0</FailedLoginThreshold>

			</LogFile>

			<!-- Exchange logins, Windows -->
			<LogFile>

				<Source>MSExchange</Source>
				<PathAndMask>
					C:/Program Files/Microsoft/Exchange Server/*/TransportRoles/Logs/FrontEnd/ProtocolLog/**.log
				</PathAndMask>
				<!--
					Example line:
					2018-10-08T15:09:27.508Z,00000000002A64E8,2,5.5.5.5:993,109.75.46.81:40016,user.name@domain.com,23,31,30,authenticate,plain,"R=""2 NO AUTHENTICATE failed."";Msg=""AuthFailed:LogonDenied,User: user.name@domain.com"";ErrMsg=AuthFailed:LogonDenied"
					Example lines (username on seperate line):
					2020-04-01T13:13:03.129Z,SRV-XCH03\External Authenticated Relay,08D7D4D2EFBC3E30,10,192.168.2.101:10587,92.118.38.34:46676,*,,Inbound AUTH LOGIN failed because of LogonDenied
					2020-04-01T13:13:03.129Z,SRV-XCH03\External Authenticated Relay,08D7D4D2EFBC3E30,11,192.168.2.101:10587,92.118.38.34:46676,*,,User Name: shaun@example.com        
					2021-04-03T03:59:48.135Z,SRV-XCH03\External Authenticated Relay,08D7D4D2EFBC3E30,11,192.168.2.101:10587,27.255.75.110:62262,>,504 5.7.4 Unrecognized authentication type,
				-->
				<FailedLoginRegex>
					<![CDATA[
						^(?<timestamp>[0-9TZ\-:\.]+),(?:.*?\\(?:.*?),)?(?:[^,\n]*,){3}(?<ipaddress>[^,\n]+).*?(?:(?:504\s5\.7\.4\s(?<log>Unrecognized\sauthentication\stype))|(?:(?<log>LogonDenied)\n?.*?(?:User\:|User\sName\:)\s(?<username>[^\n,"]+)))
					]]>
				</FailedLoginRegex>
				<SuccessfulLoginRegex>
					<![CDATA[
						^(?<timestamp>[0-9TZ\-:\.]+)?,(?:[^,\n]*,){4}(?<ipaddress>[^,\n]+),(?:[^,\n]*),(?<username>[^,\n]*),authenticated
					]]>
				</SuccessfulLoginRegex>
				<PlatformRegex>Windows</PlatformRegex>
				<PingInterval>10000</PingInterval>
				<MaxFileSize>16777216</MaxFileSize>
				<FailedLoginThreshold>0</FailedLoginThreshold>

			</LogFile>

			<!-- Smarter mail failed logins, Windows -->
			<LogFile>

				<Source>SmarterMail</Source>
				<PathAndMask>
					C:/Program Files/Smarter Tools/Smarter Mail/**/*.log
					C:/Program Files (x86)/Smarter Tools/Smarter Mail/**/*.log
					C:/SmarterMail/logs/**/*.log
					C:/Smarter Mail/logs/**/*.log
				</PathAndMask>
				<FailedLoginRegex>
					<![CDATA[
						\[(?<ipaddress>[^\]\n]+)\](?:\[[^\]\n]*\]\s+).*?
						(?<log>
							login\sfailed|
							IP\sis\sblacklisted|
							Authentication\sfailed|
							EHLO\sSMTP\sblocking\srule|
							rsp:\s554\sSecurity\sfailure|
							too\smany\sauthentication\sfailures|
							Mail\srejected\sdue\sto\sSMTP\sSpam\sBlocking|
							IP\sblocked\sby\sbrute\sforce\sabuse\sdetection\srule|
							The\sdomain\sgiven\sin\sthe\sEHLO\scommand\sviolates\san\sEHLO\sSMTP
						)
					]]>
				</FailedLoginRegex>
				<PlatformRegex>Windows</PlatformRegex>
				<PingInterval>10000</PingInterval>
				<MaxFileSize>16777216</MaxFileSize>
				<FailedLoginThreshold>0</FailedLoginThreshold>

			</LogFile>

			<!-- MailEnable mail failed logins, Windows-->
			<LogFile>

				<Source>MailEnable</Source>
				<PathAndMask>
					C:/Program Files (x86)/Mail Enable/Logging/SMTP/SMTP-Activity-*.log
					C:/Program Files/Mail Enable/Logging/SMTP/SMTP-Activity-*.log
					C:/Program Files (x86)/Mail Enable/Logging/IMAP
					C:/Program Files/Mail Enable/Logging/IMAP
				</PathAndMask>
				<!--
					Example line smtp:
					09/01/20 00:00:19	SMTP-IN	6468E5679CDC4F53AFB8064FA9FA29E6.MAI	2816	21.74.49.152	AUTH	dmNjMjAxOQ==	535 Invalid Username or Password	34	14	user.name@domain.com	
					Example line imap:
					05/24/21 00:02:38	IMAP-IN		3404	55.55.55.56	LOGIN	LOGIN "user@domain.com" "********"	001 NO LOGIN Failed - Invalid username or password.	53	42		
				-->
				<FailedLoginRegex>
					<![CDATA[
						^(?<timestamp>[0-9\/:\s]+)SMTP\-IN\s+[^\s]+\s+[^\s]+\s(?<ipaddress>[^\s]+)\s+[^\s]+\s+[^\s]+\s+[^\s]+\s+(?<log>Invalid\sUsername\sor\sPassword)\s+[^\s]+\s+[^\s]+\s+(?<username>[^\n]+)$|
						^(?<timestamp>[0-9\/:\s]+)IMAP\-IN\s+[^\s]+\s+(?<ipaddress>[^\s]+)\s+LOGIN\s+LOGIN\s+"(?<username>[^"]+)"\s+"[^"]+"\s+[^\s]+\s+NO\s+LOGIN\s+Failed\s+[^\s]+\s+(?<log>Invalid\s+username\s+or\s+password)[^\n]*$|
						^(?<timestamp>[0-9\/]+\s[0-9\:]+)\sSMTP\-IN\s[^\s]+\s[^\s]+\s(?<ipaddress>[^\s]+)\s[^\s]+\s[^\s]+\sTO\:(?<username>[^\s]+)\s[^\s]+\sthis\smail\sserver\srequires\sauthentication\swhen\sattempting\sto\ssend\sto\sa\snon-local\se-mail\saddress[^\n]+\n$
					]]>
				</FailedLoginRegex>
				<FailedLoginRegexTimestampFormat>MM/dd/yy HH:mm:ss</FailedLoginRegexTimestampFormat>
				<PlatformRegex>Windows</PlatformRegex>
				<PingInterval>10000</PingInterval>
				<MaxFileSize>16777216</MaxFileSize>
				<FailedLoginThreshold>0</FailedLoginThreshold>

			</LogFile>

			<!-- Apache (Linux and Windows) -->
			<LogFile>

				<Source>Apache</Source>
				<PathAndMask>
					C:/Program Files/Tomcat/logs/**/*access_log*.txt
					/var/log/httpd/access_log
				</PathAndMask>
				<FailedLoginRegex>
					<![CDATA[
						^(?<ipaddress>[^\s]+)\s.*?\[(?<timestamp>.*?)\].*?(?:\s(?<log>40[03])\s(-|[0-9]+)|((php|md5sum|cgi-bin|joomla).*?\s(?<log>40[03]\s[0-9]+|\s400\s-)))[^\n]*
					]]>
				</FailedLoginRegex>
				<FailedLoginRegexTimestampFormat>dd/MMM/yyyy:HH:mm:ss zzzz</FailedLoginRegexTimestampFormat>
				<PlatformRegex>Windows|Linux</PlatformRegex>
				<PingInterval>10000</PingInterval>
				<MaxFileSize>16777216</MaxFileSize>
				<FailedLoginThreshold>0</FailedLoginThreshold>

			</LogFile>

			<!-- RDWeb Log Checking
				https://learn.microsoft.com/en-us/iis/extensions/advanced-logging-module/advanced-logging-for-iis-real-time-logging

				*NOTE* If you've setup iis to log in local time, change the timestamp_utc group in the regex to just timestamp.

				Usernames are not captured in log file for failed logins, only successful logins.
				Four Example Failed Logins (1.2.3.4 Server IP 2.3.4.5 Client IP):
				2023-03-20 05:43:20 1.2.3.4 POST /RDWeb/Pages/en-US/login.aspx - 443 - 2.3.4.5 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/109.0.0.0+Safari/537.36 https://your.rdsserver.org.uk/RDWeb/webclient/ 200 0 0 15
				2023-03-20 15:33:46 1.2.3.4 POST /RDWeb/Pages/en-US/login.aspx ReturnUrl=%2FRDWeb%2FPages%2Fen-US%2FDefault.aspx 443 - 2.3.4.5 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 https://your.rdsserver.org.uk/RDWeb/Pages/en-US/login.aspx?ReturnUrl=/RDWeb/Pages/en-US/Default.aspx 200 0 0 2265
				2024-03-15 00:04:49 1.2.3.4 POST /RDWeb/Pages/en-US/login.aspx - 443 - 2.3.4.5 node-fetch/1.0+(+https://github.com/bitinn/node-fetch) - 200 0 0 763
				2024-03-21 02:47:46 1.2.3.4 POST /RDWeb/Pages/en-US/login.aspx - 443 - 2.3.4.5 - - 200 0 0 391

				Two Example successful logins:
				2023-03-20 06:38:54 1.2.3.4 POST /RDWeb/Pages/en-US/login.aspx - 443 username 2.3.4.5 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_15_7)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 https://your.rdsserver.org.uk/RDWeb/webclient/ 302 0 0 31
				2023-03-20 15:36:09 1.2.3.4 POST /RDWeb/Pages/en-US/login.aspx ReturnUrl=%2FRDWeb%2FPages%2Fen-US%2FDefault.aspx 443 domain\username 2.3.4.5 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 https://your.rdsserver.org.uk/RDWeb/Pages/en-US/login.aspx?ReturnUrl=%2FRDWeb%2FPages%2Fen-US%2FDefault.aspx 302 0 0 31
			-->
			<LogFile>
				<Source>RDWeb</Source>
				<PathAndMask>C:/inetpub/logs/LogFiles/W3SVC1/**/*.log</PathAndMask>
				<FailedLoginRegex>
					<![CDATA[
						(?<timestamp_utc>\d\d\d\d\-\d\d\-\d\d\s\d\d\:\d\d\:\d\d)\s[^\s]+\sPOST\s\/RDWeb\/Pages\/[^\/]+\/login\.aspx\s[^\s]+\s[0-9]+\s-\s(?<ipaddress>[^\s]+).*\s200\s[^\n]+\n
					]]>
				</FailedLoginRegex>
				<SuccessfulLoginRegex>
					<![CDATA[
        				(?<timestamp_utc>\d\d\d\d\-\d\d\-\d\d\s\d\d\:\d\d\:\d\d)\s[^\s]+\sPOST\s\/RDWeb\/Pages\/[^\/]+\/login\.aspx\s[^\s]+\s[0-9]+\s(?<username>[^\s\-]+)\s(?<ipaddress>[^\s]+).*\s302\s[^\n]+\n
        			]]>
				</SuccessfulLoginRegex>
				<PlatformRegex>Windows</PlatformRegex>
				<PingInterval>10000</PingInterval>
				<MaxFileSize>16777216</MaxFileSize>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<MinimumTimeBetweenFailedLoginAttempts>00:00:00:00</MinimumTimeBetweenFailedLoginAttempts>
			</LogFile>

			<!--
				Custom log entries, Windows
				Write log files to C:/IPBanCustomLogs/*.log and write this type of line to the log and ipban will add a failed login:
				2020-01-01T01:01:01Z, ipban failed login, ip address: 10.10.10.10, source: ApplicationName, user: FailedUserName
			-->
			<LogFile>

				<Source>IPBanCustom</Source>
				<PathAndMask>C:/IPBanCustomLogs/**/*.log</PathAndMask>
				<FailedLoginRegex>
					<![CDATA[
						(?<timestamp>\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d(?:\.\d+)?Z?)?(?:,\s)?(?<log>ipban\sfailed\slogin),\sip\saddress:\s(?<ipaddress>[^,\n]+),\ssource:\s(?<source>[^,\n]+)?,\suser:\s(?<username>[^\s,]+)?
					]]>
				</FailedLoginRegex>
				<!-- For a regex with NotifyOnly, this will be a successful login and handled differently (IPBAN PRO only) -->
				<SuccessfulLoginRegex>
					<![CDATA[
						(?<timestamp>\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d(?:\.\d+)?Z?)?(?:,\s)?ipban\ssuccess\slogin,\sip\saddress:\s(?<ipaddress>[^,\n]+),\ssource:\s(?<source>[^,\n]+)?,\suser:\s(?<username>[^\s,]+)?
					]]>
				</SuccessfulLoginRegex>
				<PlatformRegex>Windows</PlatformRegex>
				<PingInterval>10000</PingInterval>
				<MaxFileSize>16777216</MaxFileSize>
				<FailedLoginThreshold>0</FailedLoginThreshold>

			</LogFile>

		</LogFiles>
	</LogFilesToParse>

	<!--
		* WINDOWS ONLY *
		Setup expressions to block for Windows event viewer.
		Each entry should be in a Group tag.
		You may specify the keywords to look for as well (uses boolean AND).
		In each group there is xpath and a regex. Regex can be empty if not checked.
		It is recommended to use \s for leading and trailing spaces for the regex as those are trimmed internally at the ends of the text
		All must match in the event for it to be filtered, and at least one regex must have an ipaddress group to pull out the ip address to block.
		Use ipaddress (for ip or dns name matching) or ipaddress_exact (for exact ip address match only) in regex groups for the ip address
	-->
	<ExpressionsToBlock>
		<Groups>

			<!-- This group will block audit failures from failed login attempts -->
			<Group>
				<Source>RDP</Source>
				<Keywords>0x8010000000000000</Keywords>
				<Path>Security</Path>

				<!-- Override failed login threshold or leave 0 for default -->
				<FailedLoginThreshold>0</FailedLoginThreshold>

				<!-- Optional, override minimum time between login attempts
					<MinimumTimeBetweenLoginAttempts>00:00:00:01</MinimumTimeBetweenLoginAttempts>
				-->

				<!-- Optional, set a log level, must match exactly (case sensitive) one of the following:
					Trace, Debug, Info, Warn, Error, Critical
					<LogLevel>Warn</LogLevel>		
				-->

				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>
							<![CDATA[
								^(?<log>4625|6273)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='IpAddress' or @Name='Workstation' or @Name='SourceAddress' or @Name='ClientIPAddress']</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='ProcessName']</XPath>
						<Regex>
							<![CDATA[
								(?<source_IIS>c:\\Windows\\System32\\inetsrv\\w3wp.exe)?$
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block audit failures from failed login attempts on Windows Server 2008 with NTLM disabled -->
			<Group>
				<Source>RDP</Source>
				<Keywords>0x8010000000000000</Keywords>
				<Path>Security</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>
							<![CDATA[
								^(?<log>4653)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='FailureReason']</XPath>
						<Regex>.</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='RemoteAddress']</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block custom ipban login failures on Windows, see IPBanPlugin.cs -->
			<Group>
				<Source>IPBanCustom</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								(?<timestamp>\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d(?:\.\d+)?Z?)?(?:,\s)?(?<log>ipban\sfailed\slogin),\sip\saddress:\s(?<ipaddress>[^,]+),\ssource:\s(?<source>[^,]+)?,\suser:\s(?<username>[^\s,]+)?
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block audit failures from failed login attempts to Microsoft SQL Server -->
			<!--
				<EventData>
					<Data>username</Data> 
					<Data>Reason: Could not find a login matching the name provided.</Data> 
					<Data>[CLIENT: 192.168.1.99]</Data> 
					<Binary>184800000E000000090000004E0053003500320034003400300036000000070000006D00610073007400650072000000</Binary> 
				</EventData>
			-->
			<Group>
				<Source>MSSQL</Source>
				<Keywords>0x90000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Provider[contains(@Name,'MSSQL')]</XPath>
						<Regex></Regex>
					</Expression>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>
							<![CDATA[
								^(?<log>18456)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[1]</XPath>
						<Regex>
							<![CDATA[
								^(?<username>.+)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[2]</XPath>
						<!--			
							Examples to capture:
							-Reason: An error occurred while evaluating the password
							-Login failed for user 'username'. Reason: Failed to open the database 'db' configured in the session recovery object while recovering the connection. [CLIENT: 1.1.1.1]
							-Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Could not find a login matching the name provided. [CLIENT: 1.1.1.1]
							-Motivo: no se encontró un inicio de sesión que coincida con el nombre proporcionado.

							Examples to ignore:
							Login failed for user 'cenptuser'. Reason: Failed to open the explicitly specified database 'db'. [CLIENT: 1.1.1.1]
						-->
						<Regex>
							<![CDATA[
								^(?:(?!Reason:\sFailed\sto\sopen\sthe(?:\sexplicitly\sspecified)?\sdatabase)(?:.))+$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[3]</XPath>
						<Regex>
							<![CDATA[
								\[CLIENTE?\s?:\s?(?<ipaddress>[^\]]+)\]
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block audit failures from failed login attempts to MySQL & MariaDB Server -->
			<Group>
				<Source>MySQL</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Provider[@Name='MySQL' or @Name='MariaDB']</XPath>
						<Regex></Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								(?<log>Access denied for user) '?(?<username>[^']+)'@'(?<ipaddress>[^']+)'
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block audit failures from failed login attempts to Postgres Server -->
			<Group>
				<Source>PostgreSQL</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Provider[@Name='PostgreSQL']</XPath>
						<Regex></Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								host=(?<ipaddress>[^ ]+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block audit failures from MS Exchange -->
			<Group>
				<Source>MSExchange</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>System</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Provider[@Name='MSExchangeTransport']</XPath>
						<Regex></Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								(?<log>LogonDenied)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress_exact>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block audit failures from failed login attempts to phpMyAdmin Web Interface -->
			<Group>
				<Source>phpMyAdmin</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>phpMyAdmin</Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								(?<log>user\sdenied):\s+(?<username>[^\s]+)\s+\(mysql-denied\)\s+from\s+(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!--
				This group will block OpenSSH login failures
			-->
			<Group>
				<Source>SSH</Source>
				<Keywords>0x4000000000000000</Keywords>
				<Path>OpenSSH/Operational</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Data[@Name='payload']</XPath>
						<Regex>
							<![CDATA[
								(?<log>failed\s+password)\s+for\s+(invalid\s+user\s+)?(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+ssh|
								(?<log>did\s+not\s+receive\s+identification\s+string)\s+from\s+(?<ipaddress>[^\s]+)|
								(?<log>connection\s+(?:closed|reset))\s+by\s+(?:(?:(?:invalid|authenticating)\s+user\s+)?(?<username>[^\s]+)\s+)?(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
								(?<log>disconnected\s+from)\s+(invalid\s+user\s+)?(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
								(?<log>disconnected\s+from)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
								(?<log>disconnected\s+from\s+authenticating\s+user)\s+(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- Alternate openssh failures -->
			<Group>
				<Source>SSH</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>^0$</Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								^sshd:\spid\s[0-9]+:\sinvalid\suser\s(?<username>[^\s]+)\sfrom\s(?<ipaddress>[^\s]+)\sport\s[0-9]+
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!--
				This group will block NTLM login failures in the Applications and Services Logs > Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational log
				OpCode 14 indicates an invalid protocol, which is usually a sign of a hacker
			-->
			<Group>
				<Source>RDP</Source>
				<Keywords>0x4000000000000000</Keywords>
				<Path>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Opcode</XPath>
						<Regex>
							<![CDATA[
								^(?<log>14)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='ClientIP' or @Name='IPString']</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block audit failures from VNC to Windows -->
			<Group>
				<Source>VNC</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>^258$</Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								(?<log>Authentication\sfailed)\sfrom\s(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will block RRAS login failures to Windows -->
			<Group>
				<Source>RRAS</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>System</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>^20271$</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[2]</XPath>
						<Regex>
							<![CDATA[
								(?<username>.*)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[3]</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[4]</XPath>
						<Regex>
							<![CDATA[
								(?<log>denied|connection\swas\sprevented|Die\sRemoteverbindung\swurde\sverweigert)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- SVN failed login attempts on Windows -->
			<Group>
				<Source>SVN</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>VisualSVNServer</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>^1004$</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[1]</XPath>
						<Regex>
							<![CDATA[
								user\s(?<username>.*?):\s\(.*\)\s.*?(?<log>falsch|wrong|incorrect|bad)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[2]</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress_exact>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

		</Groups>
	</ExpressionsToBlock>

	<!--
		* WINDOWS ONLY, IPBAN PRO ONLY *
		Setup expressions to notify for Windows event viewer.
		Works exactly the same way as ExpressionsToBlock, except that you will be notified via email when
		one of these events happens, and the ip address will not be processed otherwise.
		Useful for success login monitoring.
	-->
	<ExpressionsToNotify>
		<Groups>

			<!-- Notify of succes RDP events -->
			<Group>
				<Source>RDP</Source>
				<Keywords>0x8020000000000000</Keywords>
				<Path>Security</Path>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>^4624$</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='ProcessName' or @Name='LogonProcessName']</XPath>
						<Regex>winlogon|svchost|ntlmssp</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='IpAddress' or @Name='Workstation' or @Name='SourceAddress']</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>
			<Group>
				<Source>RDP</Source>
				<Keywords>0x1000000000000000</Keywords>
				<Path>Microsoft-Windows-TerminalServices-LocalSessionManager/Operational</Path>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>
							<![CDATA[
								^(?<log>25)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Address</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//User</XPath>
						<Regex>
							<![CDATA[
								(?<username>[^\\\/]+)$
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>
			<Group>
				<Source>RDP</Source>
				<Keywords>0x4020000001000000</Keywords>
				<Path>Microsoft-Windows-TerminalServices-Gateway/Operational</Path>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>
							<![CDATA[
								^(?<log>200)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//IpAddress</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Username</XPath>
						<Regex>
							<![CDATA[
								(?<username>[^\\\/]+)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//AuthType</XPath>
						<Regex>
							NTLM
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- Notify of succes SSH events -->
			<Group>
				<Source>SSH</Source>
				<Keywords>0x4000000000000000</Keywords>
				<Path>OpenSSH/Operational</Path>
				<Expressions>
					<Expression>
						<XPath>//Data[@Name='payload']</XPath>
						<Regex>
							<![CDATA[
								Accepted\s+(?:password|publickey)\s+for\s+(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+ssh
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will notify custom ipban login success on Windows, see IPBanPlugin.cs -->
			<Group>
				<Source>IPBanCustom</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<Expressions>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								(?<timestamp>\d\d\d\d-\d\d-\d\d\s\d\d:\d\d:\d\d(?:\.\d+)?Z?)?(?:,\s)?ipban\ssuccess\slogin,\sip\saddress:\s(?<ipaddress>[^,]+),\ssource:\s(?<source>[^,]+)?,\suser:\s(?<username>[^\s,]+)?
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will notify login successes from VNC to Windows -->
			<Group>
				<Source>VNC</Source>
				<Keywords>0x80000000000000</Keywords>
				<Path>Application</Path>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>^257$</Regex>
					</Expression>
					<Expression>
						<XPath>//Data</XPath>
						<Regex>
							<![CDATA[
								Authentication\spassed\sby\s(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- This group will handle RRAS login successful attempt to Windows -->
			<Group>
				<Source>RRAS</Source>
				<Keywords>0x8020000000000000</Keywords>
				<Path>System</Path>
				<Expressions>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>^6272$</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='SubjectUserName']</XPath>
						<Regex>
							<![CDATA[
								(?<username>[^\\\/]+)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='CallingStationID']</XPath>
						<Regex>
							<![CDATA[
								(?<ipaddress>.+)
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>//Data[@Name='EAPType']</XPath>
						<Regex>
							<![CDATA[
								\s?secured\spassword\s?
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

			<!-- Successful logins to mssql -->
			<Group>
				<Source>MSSQL</Source>
				<Keywords>0xa0000000000000</Keywords>
				<Path>Application</Path>
				<FailedLoginThreshold>0</FailedLoginThreshold>
				<Expressions>
					<Expression>
						<XPath>//Provider[contains(@Name,'MSSQL')]</XPath>
						<Regex></Regex>
					</Expression>
					<Expression>
						<XPath>//EventID</XPath>
						<Regex>
							<![CDATA[
								^(?<log>18454)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[1]</XPath>
						<Regex>
							<![CDATA[
				                ^(?<username>.+)$
							]]>
						</Regex>
					</Expression>
					<Expression>
						<XPath>(//Data)[2]</XPath>
						<Regex>
							<![CDATA[
								\[CLIENTE?\s?:\s?(?<ipaddress>[^\]]+)\]
							]]>
						</Regex>
					</Expression>
				</Expressions>
			</Group>

		</Groups>
	</ExpressionsToNotify>

	<appSettings>

		<!-- Note that all app settings can use value="%[env_var_name]%" to read the value from an environment variable-->

		<!--
			Enter your https://ipthreat.net api key here to submit failed logins to the 100% free ipthreat site and service
			1] Create an account on the ipthreat website : https://ipthreat.net/account/signup
			2] Go to https://ipthreat.net/requestpermissions to get bulk report permission
			3] Once you get an email back verifying permissions, create an api key at https://ipthreat.net/account?tab=apikeys
			4] Enter your api key below (no need to restart the service)
			5] Consume https://ipthreat.net/lists lists in the FirewallUriRules appSetting for even more protection
		-->
		<add key="IPThreatApiKey" value="" />

		<!-- Number of failed logins before banning the ip address -->
		<add key="FailedLoginAttemptsBeforeBan" value="5"/>

		<!--
			The duration of time to ban an ip address (DD:HH:MM:SS) - 00:00:00:00 for 9999 days (the max duration).
			This can contain multiple time spans, separated by commas. For multiple time spans:
			When the previous ban time expires, the next failed login that causes a ban for the
			ip address will cause it to move to the next ban time. Once the last ban time has
			been passed, the ip address will be removed from the database and 
			start back at the first ban time. Multiple time spans must be in strictly ascending order.
		-->
		<add key="BanTime" value="01:00:00:00"/>

		<!--
			Ignored if only a single BanTime is specified.
			If this value is true, the failed login count will be reset to 0, causing the next failed login
			to start at 1 and then the ip address will move to the next ban time once the failed login count
			reaches FailedLoginAttemptsBeforeBan.
			If this value is false, then the failed login count will not be reset, and the next failed login
			will cause an immediate ban of the ip address into the next ban time in the BanTime list.
		-->
		<add key="ResetFailedLoginCountForUnbannedIPAddresses" value="false" />

		<!-- True to clear and unban all the ip addresses from the firewall upon restart, false otherwise -->
		<add key="ClearBannedIPAddressesOnRestart" value="false"/>

		<!-- Whether to clear all failed logins for an ip if that ip has a successful login -->
		<add key="ClearFailedLoginsOnSuccessfulLogin" value="false"/>

		<!-- Whether to process internal ip addresses -->
		<add key="ProcessInternalIPAddresses" value="false"/>

		<!-- The duration after the last failed login attempt that the ip is forgotten (count reset back to 0). Set to 00:00:00:00 to use max duration. (DD:HH:MM:SS) -->
		<add key="ExpireTime" value="01:00:00:00"/>

		<!-- How often the service should do house-keeping such as banning ip addresses, un-banning ip addresses, reloading config, etc. (DD:HH:MM:SS) -->
		<add key="CycleTime" value="00:00:00:15"/>

		<!-- The minimum time between failed login attempts for an ip address to increment the ban counter -->
		<add key="MinimumTimeBetweenFailedLoginAttempts" value="00:00:00:01"/>

		<!-- The minimum time between successful login attempts for an ip address to increment the success counter -->
		<add key="MinimumTimeBetweenSuccessfulLoginAttempts" value="00:00:00:05"/>

		<!-- Rule prefix name for firewall rules, must contain only A-Z, 0-9 and _ -->
		<add key="FirewallRulePrefix" value="IPBan_"/>

		<!--
			Comma separated list of ip addresses, cidr masks, urls or dns names that are never banned. Whitelist takes precedence over blacklist.
			If you use a url, the response should be text and newline delimited, example: https://uptimerobot.com/inc/files/ips/IPv4andIPv6.txt.
			For urls, | char is not allowed. If you need a url with this char, create a redirect without the |
			Ips in this list are added to a whitelist firewall rule and will always be allowed.
		-->
		<add key="Whitelist" value=""/>

		<!--
			Regular expression for more advanced whitelisting. Shortcut: use * to allow any piece of an ip (i.e. 128.128.128.*).
			Sample regex that whitelists a few ips: ^(128\.128\.128\..*)|(99\.99\.99\.[0-9])$
			More info about regex: http://www.regular-expressions.info/
			This regex is not added to the firewall, rather before an ip can be banned, this regex is first checked, and if match the ban is prevented.
		-->
		<add key="WhitelistRegex" value=""/>

		<!--
			Same format as Whitelist, but for entries that are always banned. Whitelist takes precedence over blacklist.
		-->
		<add key="Blacklist" value=""/>

		<!--
			Regular expression for more advanced blacklisting. Shortcut: use * to allow any piece of an ip, dns name or user name (i.e. 128.128.128.*).
			Sample regex that blacklists a few ips: ^(128\.128\.128\..*)|(99\.99\.99\.[0-9])$
			More info about regex: http://www.regular-expressions.info/    
		-->
		<add key="BlacklistRegex" value=""/>

		<!--
			When a parser finds a user name, you can truncate the username to any of the characters in this value. Set to empty to not truncate.
			Very useful when parsing email addresses and hackers are trying same user name at multiple different domain names.
		-->
		<add key="TruncateUserNameChars" value="@"/>

		<!--
			Comma separated list of user names that are allowed. UserNameWhitelistMinimumEditDistance is checked for user names not in the list
			to determine whether a failed user name should be banned. Case is ignored.
			Empty entries are allowed if you want to allow empty user names. 
			*** IMPORTANT *** This can represent an attack vector by a hacker. If they know you are using IPBan and they don't get locked out right
			away, they might know they are somewhat close to the right user name. Make sure your passwords are complex enough and this shouldn't be a problem.
		-->
		<add key="UserNameWhitelist" value=""/>

		<!--
			*** USE WITH CAUTION! IF NOT EMPTY, ANY FAILED LOGIN USER NAME THAT DOES NOT MATCH WILL RESULT IN AN AUTOMATIC BAN! ***
			User name whitelist regex. Any failed login user name that does not match will result in an immediate ban, including empty user names.
		-->
		<add key="UserNameWhitelistRegex" value=""/>

		<!--
			If the edit distance (levenshtein distance) of a failed user name is greater than this distance away, the user name is immediately banned.
			Case is ignored. Ignored if UserNameWhitelist is empty.
		-->
		<add key="UserNameWhitelistMinimumEditDistance" value="2" />

		<!-- Number of failed logins before banning the ip address if the user name is in the user name whitelist -->
		<add key="FailedLoginAttemptsBeforeBanUserNameWhitelist" value="20"/>

		<!---
			Run an external process when a ban occurs. Separate the process and any arguments with a pipe (|). The pipe is required even if arguments are empty.
			Example: c:\files\on_ip_banned.exe|###IPADDRESS### -q
			###IPADDRESS### will be replaced with the actual IP which was banned.
			###USERNAME### will be replaced with the username if known.
			###SOURCE### will be replaced with the source if known.
			###APP### will be replaced with the app name and version.
			###COUNT### will be replaced with the number of events.
			###LOG### will be replaced with matching log text that triggered the event, if known.
			Can run multiple processes by delimiting each with a newline
		-->
		<add key="ProcessToRunOnBan" value=""/>

		<!---
			Run an external process when a successful login occurs. Separate the process and any arguments with a pipe (|). The pipe is required even if arguments are empty.
			Example: c:\files\on_ip_banned.exe|###IPADDRESS### -q
			###IPADDRESS### will be replaced with the actual IP which was banned.
			###USERNAME### will be replaced with the username if known.
			###SOURCE### will be replaced with the source if known.
			###APP### will be replaced with the app name and version.
			###COUNT### will be replaced with the number of events.
			###LOG### will be replaced with matching log text that triggered the event, if known.
			Can run multiple processes by delimiting each with a newline
		-->
		<add key="ProcessToRunOnSuccessfulLogin" value=""/>

		<!---
			Run an external process when an unban occurs. Separate the process and any arguments with a pipe (|). The pipe is required even if arguments is empty.
			Example: c:\files\on_ip_unbanned.exe|###IPADDRESS### -q
			###IPADDRESS### will be replaced with the actual IP which was unbanned.
			Can run multiple processes by delimiting each with a newline
		-->
		<add key="ProcessToRunOnUnban" value=""/>

		<!--
			Firewall rules to create to allow or block ip addresses, one per line. Great way to persist firewall rules.
			Format is rule-name;allow or block;ip list (comma separated);port list (comma separated);platform regex
			For allow rules, port list is allowed ports, so if you wanted to allow port 3389, just enter 3389.
			For block rules, port list is ignored ports, so if you wanted to block port 3389, you'd enter 0-3388,3390-65535.
			You can leave the allowed port list empty to have the rule apply to all ports
			The name should be kept to 16 or less chars
			See https://www.mediawiki.org/wiki/Help:Range_blocks and https://www.mediawiki.org/wiki/Help:Range_blocks/IPv6
			Negative look ahead regex: https://stackoverflow.com/questions/23724661/regex-to-negate-the-whole-word
			Put your allow rules first, then your block rules, for Linux iptables this is important, on Windows order does not matter, block rules have precedence
			On Windows firewall, all traffic is blocked by default, so only allow rules are needed, order does not matter
			On Linux iptables, all traffic is allowed by default, so allow rules are still needed but should go before any block rules
			On Linux, ipset has a bug where cidr mask /0 is not allowed, so you must split half and half of the ipv4 and ipv6 range
			Example that allows Redis from certain ip, and blocks everything except ssh, rdp, http/https:
			RedisAllowIP;allow;10.0.0.1,10.0.0.2,192.168.1.168/24;6379;.
			WebOnly;block;0.0.0.0/1,128.0.0.0/1,::/1,8000::/1;22,80,443,3389;^(?:(?!Windows).)+$
		-->
		<add key="FirewallRules" value="

		"/>

		<!--
			Whether to use the default banned ip address handler for banned ip address sharing. Set to false to turn this off.
		-->
		<add key="UseDefaultBannedIPAddressHandler" value="true" />

		<!-- 
			Url to query to get the external ip address, the url should return a string which is the external ip address.
		-->
		<add key="ExternalIPAddressUrl" value="https://checkip.amazonaws.com/"/>

		<!--
			External firewall uri rules to block, format is (one per line):
			[RulePrefix],[Interval in DD:HH:MM:SS],[URI],[MaxCount][Newline]
		-->
		<add key="FirewallUriRules" value=""/>
		<!-- Example for emerging threats
			EmergingThreats,01:00:00:00,https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt,10000
		-->

		<!--
			A url to get when the service cycle runs, empty for none.
			Example: http://192.168.1.2/ipban/update?ip=###IPADDRESS###&amp;remoteIp=###REMOTEIPADDRESS###&amp;name=###MACHINENAME###&amp;version=###VERSION###&amp;guid=###GUID###&amp;osname=###OSNAME###&amp;osversion=###OSVERSION###
	    -->
		<add key="GetUrlUpdate" value=""/>

		<!--
			A url to get when the service starts, empty for none.
			Example: http://192.168.1.2/ipban/start?ip=###IPADDRESS###&amp;remoteIp=###REMOTEIPADDRESS###&amp;name=###MACHINENAME###&amp;version=###VERSION###&amp;guid=###GUID###&amp;osname=###OSNAME###&amp;osversion=###OSVERSION###
		-->
		<add key="GetUrlStart" value=""/>

		<!--
			A url to get when the service stops, empty for none.
			Example: http://192.168.1.2/ipban/stop?ip=###IPADDRESS###&amp;remoteIp=###REMOTEIPADDRESS###&amp;name=###MACHINENAME###&amp;version=###VERSION###&amp;guid=###GUID###&amp;osname=###OSNAME###&amp;osversion=###OSVERSION###
		-->
		<add key="GetUrlStop" value=""/>

		<!--
			A url to get config file from, empty for none. Make sure your remote config has the GetUrlConfig set to this same value :)
			Example: http://192.168.1.2/ipban/config?guid=###GUID###
		-->
		<add key="GetUrlConfig" value=""/>

		<!--
			================================================================
			IPBan Pro Version Only Parameters, Ignored For Free Version
			================================================================
		-->

		<!--
			A url to connect to an IPBan pro server via web socket. Allows sending and receiving data and commands via web socket.
			Examples: ws://localhost:52664/
		-->
		<add key="IPBanPro_UrlWebSocket" value=""/>

	</appSettings>

</configuration>