Download
this file.
It's a CSV file which gives you both Internet standard and network formats.
Extract the standard format ranges you want using something like:
Code:
zcat GeoIPCountryCSV.zip | grep 'Vietnam\|China\|Russia' | \
awk -F',' '{print $1 $2}' | awk -F'\"\"' '{print $1 "-" $2}' | awk -F'\"' '{print $2}' > bad_ips.txt
Now you've got a
bad_ips.txt file with all the ranges you want to block in it (one range per line).
Now create an iptables chain to use it in:
Code:
iptables -N BAD_IPS
Now use a
for loop to stick the rules in the chain:
Code:
for i in `cat bad_ips.txt`; do iptables -A BAD_IPS -m iprange --src-range $i -j DROP; done
That loop might take a while to complete depending on your CPU and how many ranges are in the
bad_ips.txt file.
Now you can send packets into that chain from wherever you want. Make sure you don't send packets in states RELATED or ESTABLISHED into that chain, or else you might run into performance issues. In other words, I suggest something like this:
Code:
iptables -P INPUT DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -j BAD_IPS
iptables -A INPUT -p TCP --dport 22 -m state --state NEW -j ACCEPT
PS: Yes, I know the range extraction script I put together is really ugly (I suck at scripting).
But I can assure it works because I tested it before posting.
