Simple spamhaus ipset firewall block

fw_block.sh

#!/usr/bin/bash

## Run every 24h via cron
## Old entries will time out later automatically

(
        cd /var/lib/firewall
        wget -qN 'http://www.spamhaus.org/drop/drop.txt' 

        ipset create -exist spamhaus_drop hash:net counters timeout 90000 comment

        for line in $(grep -i SBL drop.txt | cut -f  1 -d ';')
        do
                if [[ $line =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$ ]]; then
                        ipset -! add spamhaus_drop "$line" comment "$(date)"
                fi
        done

        ## This rules should be static in the main firewall rule script, they don't need any update.
        # iptables -I INPUT -m set --match-set spamhaus_drop src -j DROP
        # iptables -I INPUT -m set --match-set spamhaus_drop src -m hashlimit --hashlimit 1/second --hashlimit-name logging --hashlimit-mode srcip --jump LOG --log-level warning --log-prefix "SPAMHAUS_DROP: "
)

Hi, Your script won't block because these lines are commented.

iptables -I INPUT -m set --match-set spamhaus_drop src -j DROP
iptables -I INPUT -m set --match-set spamhaus_drop src -m hashlimit --hashlimit 1/second --hashlimit-name logging --hashlimit-mode srcip --jump LOG --log-level warning --log-prefix "SPAMHAUS_DROP: "

for line in $(cat drop.txt | grep -i SBL | cut -f 1 -d ';')

more simple
for line in $(grep -i SBL drop.txt | cut -f 1 -d ';')

@xpunkt can I award myself a Useless Use of Cat Award? ;-)
TNX BTW.

Hi, Your script won't block because these lines are commented.

Those where just for reference since they where in my main firewall script. Those rules are static while the ipsets are not.
Thanks for feedback.