Skip to content

Instantly share code, notes, and snippets.

@toke
Last active April 24, 2023 09:36
Show Gist options
  • Save toke/0474b80308de68e13d8c6b21156b5fec to your computer and use it in GitHub Desktop.
Save toke/0474b80308de68e13d8c6b21156b5fec to your computer and use it in GitHub Desktop.
Simple spamhaus ipset firewall block
#!/usr/bin/bash
## Run every 24h via cron
## Old entries will time out later automatically
(
cd /var/lib/firewall
wget -qN 'http://www.spamhaus.org/drop/drop.txt'
ipset create -exist spamhaus_drop hash:net counters timeout 90000 comment
for line in $(grep -i SBL drop.txt | cut -f 1 -d ';')
do
if [[ $line =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$ ]]; then
ipset -! add spamhaus_drop "$line" comment "$(date)"
fi
done
## This rules should be static in the main firewall rule script, they don't need any update.
# iptables -I INPUT -m set --match-set spamhaus_drop src -j DROP
# iptables -I INPUT -m set --match-set spamhaus_drop src -m hashlimit --hashlimit 1/second --hashlimit-name logging --hashlimit-mode srcip --jump LOG --log-level warning --log-prefix "SPAMHAUS_DROP: "
)
@toke
Copy link
Author

toke commented Jun 20, 2019

@xpunkt can I award myself a Useless Use of Cat Award? ;-)
TNX BTW.

@toke
Copy link
Author

toke commented Jun 21, 2019

Hi, Your script won't block because these lines are commented.

Those where just for reference since they where in my main firewall script. Those rules are static while the ipsets are not.
Thanks for feedback.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment