firewall 에서 ip를 차단하기 위한 script

firewallcmd-drop-client.sh

#!/bin/bash
ZONE="service"

function  usage {
    echo "USAGE: $0 param"
    echo ""
    echo "$0 -i block-ip1,block-ip2"
    echo "$0 -f block-ip-file"
    exit 1
}

if [ "$#" -lt 1 ]; then
    usage;
fi

PARAM="f:i:h";

while getopts $PARAM opt; do
  case $opt in
    f)
        while IFS='' read -r line || [[ -n "$line" ]]; do
            # echo "Block IP: $line"

            ## 맨 앞에 , 가 붙는 걸 방지하기 위해 IPS 변수의 length 확인
            if [ -z "$IPS" ];then
                IPS="$line";
            else
                IPS="$IPS,$line";
            fi
        done < "$OPTARG"
        ;;
    i)
        IPS=$OPTARG;
        ;;
    *)
        usage;
        ;;
  esac
done

#echo "To be blocked IPS=$IPS"

IFS=','
for ip in $IPS; do
    CMD="firewall-cmd --zone=${ZONE} --add-rich-rule='rule family=\"ipv4\" source address=\"${ip}\" drop'"
    echo "${CMD}  --permanent" | bash -x

done

echo ""
RELOAD="firewall-cmd --reload"
echo "${RELOAD}" | bash -x

echo "if you want to remove rich-rule run this"

echo "firewall-cmd --permanent --zone=${ZONE} --add-rich-rule='rule family=\"ipv4\" source address=\"remove-ip-here\" drop'"