Checks which IPs are connected to the server, blocking it at the firewall when it passes a certain limit

block_ip_in_firewall_by_limit_connections.sh

#!/bin/bash

file_ip_list="_list_ips_conected_p80.txt"
file_log_ips="ips_blocked.log"
file_firewall=/etc/firewall/IPDROP_GLOBAL

#CREATE A LIST OF IPS CONNECTED TO PORT 80
netstat -pant | grep :80 | awk '{ print $5}' | cut -d: -f1 | sort | uniq -c | sort -n > ${file_ip_list}

#READ EVERY LINE IN THE LIST
#VERIFY TOTAL IP CONNECTIONS
#BLOCKED ON FIREWALL IF YOU PASS REACH THE CONNECTION LIMIT
limit_connections=20
total_ips=0
while read -r line
do
    read -a arr <<< ${line}
    #CHECKS IF THE IP HAS ALREADY BEEN ADDED TO THE FIREWALL
    if ! grep -wq "${arr[1]}" ${file_firewall}; then 
        total_connections=$(($arr-$limit_connections))
        if [[ $total_connections -ge 0 ]]; then
                total_ips=$((total_ips+1))
                echo "Blocking ${arr[1]}, ${arr[0]} connections"
                echo "${arr[0]};${arr[1]};$(date '+%Y-%m-%d %H:%M:%S')" >> ${file_log_ips}
                echo "${arr[1]}" >> ${file_firewall}    
        fi
    fi
    #echo "--------------------"
done < ${file_ip_list}

unlink ${file_ip_list}

#RESTART THE FIREWALL SERVER, IF ANY IP HAS BEEN BLOCKED
echo "${total_ips} blocked"

if [[ $total_ips -ge 1 ]];
    then
        echo "Restarting firewall"
        service firewall restart
fi