mkorthof / ipset-country Goto Github PK

View Code? Open in Web Editor NEW

70.0 8.0 24.0 51 KB

Block countries using iptables + ipset + ipdeny.com

License: GNU General Public License v2.0

Shell 100.00%

iptables ipdeny firewalld shell-script ipset nft nftables country countrycodes blacklist

ipset-country's Introduction

ipset-country

Block or allow countries using iptables, ipset and ipdeny.com

This used to be a Gist but was moved here instead
Please do not add Gist comments, but create an issue here

Also works with ipverse.com and other providers
Supports RH, Debian with iptables and/or firewalld
Both ipv4 and ipv6 are supported

Installation

Setup firewall if you have not done so yet, at least INPUT chain is needed
Run this script from cron, e.g. /etc/cron.daily or a systemd timer (see below)
To run on boot you can also add it to e.g. /etc/rc.local or systemd
Use argument "-f" to load unchanged zonefiles instead of skipping

To automatically setup a systemd service and daily timer run: ipset-country -i
To uninstall run:ipset-country -u

Running this script will insert an iptables 'REJECT' or 'DROP' rule for ipset. Make sure you do not lock yourself out in case of issues on a remote system.

In case of issues check the log file (/var/log/ipset-country.log)

Configuration

All options are set and explained in the script itself: ipset-country

Optionally you can use a seperate config file located in the same directory as the script, "/etc" or "/usr/local/etc". Specify a custom location using ipset-country -c /path/to/conf

The config file will overwrite any options set in script. To create a new conf file run:

sed -n '/# CONFIGURATION:/,/# END OF CONFIG/p' ipset-country > ipset-country.conf

Distro:

If needed change OS using DISTRO setting. Default is "auto" which should be OK.

Options are:

"auto", "debian" or "redhat"
"manual"
- confdir="/etc/iptables" (example)
- rulesfile="${confdir}/myrules" (example)

Countries:

Specify countries to block as "ISOCODE,Name" (same as ipdeny.com), multiple entries should be seperated by semicolon ;

Example:
COUNTRY="CN,China; US,United States; RU,Russia"

Firewalls and options:

Iptables and ipset are used by default to create the chains, rules and ipsets. If firewalld frontend is enabled it will be used instead.

Blacklist: block specified Countries, set MODE to "reject" or "drop"
Whitelist: allow specified Countries and block all others, set MODE to "accept"

Iptables:

Set target to use when ip matches country: "accept", "drop" or "reject". Default is MODE="reject"

FirewallD:

Set this option to "1" to enable firewalld: FIREWALLD=0

Set FIREWALLD_MODE=0 to use the default Blacklist mode (uses 'drop' zone). Change to "1" for Whitelist ('public' zone). See MODE above for more information

NOTE: There are issues with firewalld on CentOS/RHEL 8 which can cause your firewall to break resulting in being locked out. Adding large ipsets apparently can take a VERY long time. To abort you need remote console access and run pkill firewal-cmd; nft flush ruleset

Block list providers:

Set URLs for ipv4 and/or ipv6 block files, you probably do not have to change these.
To use ipverse.net instead of ipdeny.com and for more details see script

IPBLOCK_URL_V4="http://www.ipdeny.com/ipblocks/data/aggregated"
IPBLOCK_URL_V6="http://www.ipdeny.com/ipv6/ipaddresses/blocks"

Logs:
In case you want to change file location set: LOG="/var/log/ipset-country.log"

IPset

Useful ipset commands:

ipset list
ipset test setname <ip>
ipset flush
ipset destroy

Changes

[20220227] fixed iptables-legacy paths (pr #16 by mainboarder)
[20201212] added config file option, systemd install (pr #14 by srulikuk)
[20201108] added flush option, fix restore=0 (pr #13 by srulikuk)
[20200927] fixed restore + logips bug (pr #10 by G4bbix)
[20200605] added Blacklist/Whitelist mode (#3)
[20200129] added option to DROP instead of REJECT (#1)
[20191116] added ipverse support, md5check option
[20190905] tested on debian 10 and centos 7
[20190905] blocking multiple countries should work
[20190905] it will check if INPUT chain exists in iptables
[20190905] cleaned it up a bit
[20190905] using firewalld is also supported now

Alternatives

Also available: github.com/tokiclover/dotfiles/blob/master/bin/ips.bash

ipset-country's People

Contributors

Stargazers

Watchers

ipset-country's Issues

Block all incoming and outgoing traffic

I noticed that only incoming TCP connections are blocked but not incoming e.g. UDP packets. If a country is block then no incoming traffic should be a allowed.
To my surprise, outgoing traffic is not blocked. Why? Outgoing traffic to a blocked country should be blocked too.

Warning: iptables-legacy tables present, use ip6tables-legacy to see them

How to deal with this?
Warning: iptables-legacy tables present, use ip6tables-legacy to see them

iptables-legacy -S
-N LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-singapore src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-india src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-russia src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-belarus src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-vietnam src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-iran src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-hong_kong src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-thailand src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-korea src -j LOGIPS
-A INPUT -p tcp -m set --match-set ipv4-china src -j LOGIPS
-A LOGIPS -m limit --limit 10/min -j LOG --log-prefix "IPS: " --log-level 3
-A LOGIPS -j DROP

crontab

Is it possible to check a zone and the update by crontab in the script ?

this file could do it right?

https://gist.github.com/paul-chambers/6856c8111183be58f8ca88c34c4e7318

Limitation of country codes

170.106.0.0/16 is reported as being in Singapore SG but when you look at the WHOIS record near the bottom it says Tencent in Beijing.

add DROP rule option

@rshackleford2020 commented 3 days ago

This is a great little script, very easy to set up and use. It only took a few minutes to get it up and running on Debian 10. Wouldn't DROP be preferable to REJECT though in the iptables rules? (Maybe make it a config choice?)

https://gist.github.com/mkorthof/3033ff64c4a5b4bd31336d422104d543#gistcomment-3154651

Check LOGIPS error from ipt when using REJECT

In certain cases iptables seems to complain the LOGIPS chain does not exist, why did it not get created?

Do you have a tutorial to install it ? It just said "exiting"

I tried to install you script but after installed iptables and ipset, and running your script it just says "exiting...".

Some questions

Thanks for this script, was gonna write my own but found this ;-) I want to understand a few things in the script and will be grateful if you find the time to respond.

Why require to use iptables-restore? furthermore I can only find that iptables-save is used to grep rules, when is the rules.v{4/6} created / written to? - For myself I want to disable the restore function as I rely on other scripts to restore rules but want to understand this before I proceed.
When updating does it only add new IP blocks or does it also remove anything that's not in the new downloaded file? - this is not easily clear from the ipset command. - Also wouldn't it be more efficient to replace the rule with the new file rather then checking for each ipblock?

Thanks

how to setup the opposite, instead block, allow

Hi.

it's a wonderful job that you did!
I was reading and I didnt find a solution for block all (dont need the search on list) and unlock just for me country goal.
Is that this option?

If I use the list for block all countries and leave just my country goal unlocked dont make sense because I'll spend too much processor on it. Is better I wont search in the list but I ll block all and just search my contry in the list for unlock.

Do you think that is possible?

Thanks!

Feature request

I would like to be able to exclude some ip's/subnet from being blocked.

Thanks.

Add option to allow instead to drop

Could you add an option to allow listed countries instead of drop listed countries ?

Add Entware as a supported distribution?

Would it be feasible to add Entware as a supported distribution? This script would be really useful on devices such as routers running DD-WRT and Linux-based NASes that support Entware, which provides full versions of ipset and iptables and most standard LInux utilities to supplant the embedded BusyBox versions. The major difference is that everything is installed under /opt, so for example /etc becomes /opt/etc, /sbin/ipset is in /opt/sbin/ipset, etc.