Skip to content

Instantly share code, notes, and snippets.

Created Nov 11, 2013
What would you like to do? - simple script to block all traffic from china
#Copyright 11.11.13 Michell Gailing <>
#It's Licensed under DWWWI 'Do whatever you want with it!'
sed -i '1,4d' chinacidr.txt
sed -i 's/ China//g' chinacidr.txt
ipset create china hash:net
while read line; do ipset add china ; done < chinacidr.txt
iptables -I INPUT -m set --match-set china src -j DROP
rm chinacidr.txt
Copy link

urbinasolutions commented Dec 30, 2013

Hi ! May I ask you how do you obtain chinacidr.txt ? Just to check its reliability. I am currently interested in drop by country but I do not want to fail dropping some of my allowed users :)

Copy link

urbinasolutions commented Dec 30, 2013

Script complains about 2nd mandatory argument for ipset :(
I've tried with something like :

for ip in $(cat chinacidr.txt); do ipset add china $ip; done;

But then I check iptables and I just find :

iptables -v -L -n | grep china
0 0 DROP all -- * * match-set china src

Which, as I do not yet know ipset, I am not sure if it is right

Copy link

thepapanoob commented Jan 7, 2014

Oh pardon i forgot the $line variable
and i get the chinacidr.txt from
you can get the working code at

Copy link

daslicht commented Jul 9, 2014

Currently I have iptables and ajenti installed to manage my server.
ipset seams not to be installed. Will it be enough to just install ipset to make iptables work with ipset ?


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment