whitelist-country-iptables.sh

#! /bin/bash

# Set the country code (in lower case)
cc=nz

# Create the ipset
ipset create allowed_country hash:net

# Load the country set 
wget -qO- "https://iplists.firehol.org/files/geolite2_country/country_$cc.netset" | grep -v ^# | xargs -n1 ipset add allowed_country

# Create chain to restrict by country
iptables -N restrict_by_country
iptables -A restrict_by_country -m set --match-set allowed_country src -j ACCEPT
iptables -A restrict_by_country -j LOG
iptables -A restrict_by_country -j REJECT

# Replace ens32 with your interface
iptables -I INPUT -i ens32 -m conntrack --ctstate NEW,UNTRACKED -j restrict_by_country