Skip to content

Instantly share code, notes, and snippets.

/gist:7415239
Created Nov 11, 2013

Embed
What would you like to do?
block-china.sh - simple script to block all traffic from china
#!/bin/bash
#Copyright 11.11.13 Michell Gailing <gailing.michell@gmail.com>
#It's Licensed under DWWWI 'Do whatever you want with it!'
wget http://www.okean.com/chinacidr.txt
sed -i '1,4d' chinacidr.txt
sed -i 's/ China//g' chinacidr.txt
ipset create china hash:net
while read line; do ipset add china ; done < chinacidr.txt
iptables -I INPUT -m set --match-set china src -j DROP
rm chinacidr.txt
@urbinasolutions

This comment has been minimized.

Copy link

urbinasolutions commented Dec 30, 2013

Hi ! May I ask you how do you obtain chinacidr.txt ? Just to check its reliability. I am currently interested in drop by country but I do not want to fail dropping some of my allowed users :)

@urbinasolutions

This comment has been minimized.

Copy link

urbinasolutions commented Dec 30, 2013

Script complains about 2nd mandatory argument for ipset :(
I've tried with something like :

for ip in $(cat chinacidr.txt); do ipset add china $ip; done;

But then I check iptables and I just find :

iptables -v -L -n | grep china
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 match-set china src

Which, as I do not yet know ipset, I am not sure if it is right

@thepapanoob

This comment has been minimized.

Copy link

thepapanoob commented Jan 7, 2014

Oh pardon i forgot the $line variable
and i get the chinacidr.txt from http://www.okean.com/chinacidr.txt
you can get the working code at https://gist.github.com/Kruemmelmonster/8304729

@daslicht

This comment has been minimized.

Copy link

daslicht commented Jul 9, 2014

Currently I have iptables and ajenti installed to manage my server.
ipset seams not to be installed. Will it be enough to just install ipset to make iptables work with ipset ?

Cheers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.