IPTABLES BLOCK ALL NON-US IP's

cachemonet · 06-14-2006, 10:57 AM

Lately I have been getting slammed with brute force attacks from overseas All of my valid clients are here in The States. I'd like to block all blocks outside of the US. I am having difficulty finding a good list of all world ip addresses. Due to the volume I'd like to allow all of the US blocks and then do an implicit deny. Does anyone have such a list? Any suggestions?

lucktsm · 06-14-2006, 11:25 AM

You can create a block list and apply it to iptables to drop. The ony problem is there are so many ip ranges to keep up with it's nearly impossible to do.

Take a look at blackhole lists and check out SANS block list. It's a good start.

////// · 06-14-2006, 04:02 PM

http://www.google.com/search?hl=en&l...es&btnG=Search
http://people.netfilter.org/peejix/g...p-HOWTO-1.html

You need to patch kernel if you want to use this match.

cachemonet · 06-14-2006, 04:57 PM

Thats the stuff. Thanks. I looked at geoip but I did not see anything that was as easy as geoip match. I knew there had to be something out there. Thanks. Now i feel stupid for not finding it. My google-fu was weak today.