updated with new scripts
This commit is contained in:
root
parent
0167c62088
commit
3340d0695d
12
README.md
12
README.md
|
|
@ -6,14 +6,6 @@ The different files are listed in lists and are hopefully somewhat self explanat
|
||||||
|
|
||||||
Anything with .list end in the zone folder will be added to the block list. This was initially used to block countries, but you can use it to block anything.
|
Anything with .list end in the zone folder will be added to the block list. This was initially used to block countries, but you can use it to block anything.
|
||||||
|
|
||||||
Add ```update.sh``` in your cron
|
This now uses systemd. Move the systemd service and do a ```systemstl daemon-reload``` then ```systemctl enable iptables --now```
|
||||||
|
|
||||||
Load iptables and ipset rules however you please on start up
|
There may be a better way to do this, but this works for me on my servers.
|
||||||
|
|
||||||
This is done by the following. Some of my servers have it in ```/etc/rc.local``` others have it in ```/etc/network/interface``` as post-up script
|
|
||||||
|
|
||||||
```iptables-restore < /path/to/iptables.save```
|
|
||||||
|
|
||||||
```ipset restore < /path/to/ipset.save```
|
|
||||||
|
|
||||||
There may be a better way to do this, but this works for me on some servers.
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
# iptables
|
||||||
|
|
||||||
|
Here is my script that I use to update iptables with data.
|
||||||
|
|
||||||
|
The different files are listed in lists and are hopefully somewhat self explanatory
|
||||||
|
|
||||||
|
Anything with .list end in the zone folder will be added to the block list. This was initially used to block countries, but you can use it to block anything.
|
||||||
|
|
||||||
|
Add ```update.sh``` in your cron
|
||||||
|
|
||||||
|
Load iptables and ipset rules however you please on start up
|
||||||
|
|
||||||
|
This is done by the following. Some of my servers have it in ```/etc/rc.local``` others have it in ```/etc/network/interface``` as post-up script
|
||||||
|
|
||||||
|
```iptables-restore < /path/to/iptables.save```
|
||||||
|
|
||||||
|
```ipset restore < /path/to/ipset.save```
|
||||||
|
|
||||||
|
There may be a better way to do this, but this works for me on some servers.
|
||||||
|
|
@ -37735,169 +37735,3 @@ add drop 121.101.64.0/18
|
||||||
add drop 94.125.186.0/24
|
add drop 94.125.186.0/24
|
||||||
add drop 212.40.192.0/19
|
add drop 212.40.192.0/19
|
||||||
add drop 195.128.96.0/22
|
add drop 195.128.96.0/22
|
||||||
create allowHTTPS hash:net family inet hashsize 1024 maxelem 65536
|
|
||||||
add allowHTTPS 173.245.48.0/20
|
|
||||||
add allowHTTPS 103.31.4.0/22
|
|
||||||
add allowHTTPS 172.64.0.0/13
|
|
||||||
add allowHTTPS 197.234.240.0/22
|
|
||||||
add allowHTTPS 198.41.128.0/17
|
|
||||||
add allowHTTPS 188.114.96.0/20
|
|
||||||
add allowHTTPS 141.101.64.0/18
|
|
||||||
add allowHTTPS 108.162.192.0/18
|
|
||||||
add allowHTTPS 190.93.240.0/20
|
|
||||||
add allowHTTPS 131.0.72.0/22
|
|
||||||
add allowHTTPS 104.16.0.0/12
|
|
||||||
add allowHTTPS 162.158.0.0/15
|
|
||||||
add allowHTTPS 103.22.200.0/22
|
|
||||||
add allowHTTPS 103.21.244.0/22
|
|
||||||
create allowSSH hash:net family inet hashsize 1024 maxelem 65536
|
|
||||||
add allowSSH 97.255.128.0/18
|
|
||||||
add allowSSH 174.255.255.254
|
|
||||||
add allowSSH 70.223.240.0/21
|
|
||||||
add allowSSH 70.223.254.0/24
|
|
||||||
add allowSSH 70.223.255.254
|
|
||||||
add allowSSH 70.223.255.248/30
|
|
||||||
add allowSSH 174.255.240.0/21
|
|
||||||
add allowSSH 70.208.0.0/13
|
|
||||||
add allowSSH 70.223.255.252/31
|
|
||||||
add allowSSH 66.174.255.240/29
|
|
||||||
add allowSSH 69.103.255.255
|
|
||||||
add allowSSH 97.255.255.0/25
|
|
||||||
add allowSSH 174.255.255.240/29
|
|
||||||
add allowSSH 69.82.0.0/16
|
|
||||||
add allowSSH 66.174.255.254
|
|
||||||
add allowSSH 66.174.192.0/19
|
|
||||||
add allowSSH 172.32.0.0/11
|
|
||||||
add allowSSH 192.182.251.66
|
|
||||||
add allowSSH 97.254.0.0/16
|
|
||||||
add allowSSH 174.255.255.192/27
|
|
||||||
add allowSSH 69.103.254.0/24
|
|
||||||
add allowSSH 206.29.160.0/19
|
|
||||||
add allowSSH 70.223.248.0/22
|
|
||||||
add allowSSH 69.103.192.0/19
|
|
||||||
add allowSSH 174.248.0.0/14
|
|
||||||
add allowSSH 97.255.255.252/31
|
|
||||||
add allowSSH 69.83.254.0/24
|
|
||||||
add allowSSH 70.223.255.128/26
|
|
||||||
add allowSSH 72.250.0.0/17
|
|
||||||
add allowSSH 69.83.255.224/28
|
|
||||||
add allowSSH 69.83.128.0/18
|
|
||||||
add allowSSH 97.248.0.0/14
|
|
||||||
add allowSSH 174.255.255.248/30
|
|
||||||
add allowSSH 69.103.255.192/27
|
|
||||||
add allowSSH 45.76.15.216/31
|
|
||||||
add allowSSH 97.255.240.0/21
|
|
||||||
add allowSSH 66.174.255.248/30
|
|
||||||
add allowSSH 69.103.240.0/21
|
|
||||||
add allowSSH 97.255.255.224/28
|
|
||||||
add allowSSH 97.255.255.255
|
|
||||||
add allowSSH 69.102.0.0/16
|
|
||||||
add allowSSH 69.83.255.248/30
|
|
||||||
add allowSSH 66.174.252.0/23
|
|
||||||
add allowSSH 70.223.0.0/17
|
|
||||||
add allowSSH 69.103.224.0/20
|
|
||||||
add allowSSH 66.174.255.192/27
|
|
||||||
add allowSSH 66.174.254.0/24
|
|
||||||
add allowSSH 70.223.255.192/27
|
|
||||||
add allowSSH 69.103.128.0/18
|
|
||||||
add allowSSH 208.54.0.0/17
|
|
||||||
add allowSSH 69.83.255.0/25
|
|
||||||
add allowSSH 72.240.0.0/15
|
|
||||||
add allowSSH 174.255.255.128/26
|
|
||||||
add allowSSH 69.83.255.252/31
|
|
||||||
add allowSSH 208.54.128.0/19
|
|
||||||
add allowSSH 70.223.252.0/23
|
|
||||||
add allowSSH 50.28.192.0/18
|
|
||||||
add allowSSH 157.230.229.117
|
|
||||||
add allowSSH 174.254.0.0/16
|
|
||||||
add allowSSH 162.160.0.0/11
|
|
||||||
add allowSSH 97.255.0.0/17
|
|
||||||
add allowSSH 174.255.224.0/20
|
|
||||||
add allowSSH 69.103.255.224/28
|
|
||||||
add allowSSH 70.223.255.224/28
|
|
||||||
add allowSSH 66.174.255.0/25
|
|
||||||
add allowSSH 69.103.255.128/26
|
|
||||||
add allowSSH 70.192.0.0/12
|
|
||||||
add allowSSH 97.240.0.0/13
|
|
||||||
add allowSSH 97.255.254.0/24
|
|
||||||
add allowSSH 174.224.0.0/12
|
|
||||||
add allowSSH 69.103.248.0/22
|
|
||||||
add allowSSH 70.220.0.0/15
|
|
||||||
add allowSSH 174.255.252.0/23
|
|
||||||
add allowSSH 70.223.128.0/18
|
|
||||||
add allowSSH 69.103.255.254
|
|
||||||
add allowSSH 174.255.254.0/24
|
|
||||||
add allowSSH 69.83.252.0/23
|
|
||||||
add allowSSH 97.252.0.0/15
|
|
||||||
add allowSSH 69.83.240.0/21
|
|
||||||
add allowSSH 174.141.208.0/20
|
|
||||||
add allowSSH 174.240.0.0/13
|
|
||||||
add allowSSH 66.174.128.0/18
|
|
||||||
add allowSSH 45.76.28.244
|
|
||||||
add allowSSH 69.83.255.255
|
|
||||||
add allowSSH 69.103.255.248/30
|
|
||||||
add allowSSH 97.255.192.0/19
|
|
||||||
add allowSSH 216.155.160.0/20
|
|
||||||
add allowSSH 97.224.0.0/12
|
|
||||||
add allowSSH 69.83.248.0/22
|
|
||||||
add allowSSH 174.255.255.255
|
|
||||||
add allowSSH 66.174.255.252/31
|
|
||||||
add allowSSH 45.76.15.216
|
|
||||||
add allowSSH 174.255.248.0/22
|
|
||||||
add allowSSH 69.103.0.0/17
|
|
||||||
add allowSSH 70.223.255.0/25
|
|
||||||
add allowSSH 174.255.128.0/18
|
|
||||||
add allowSSH 69.83.255.254
|
|
||||||
add allowSSH 70.216.0.0/14
|
|
||||||
add allowSSH 174.252.0.0/15
|
|
||||||
add allowSSH 174.255.192.0/19
|
|
||||||
add allowSSH 69.103.255.252/31
|
|
||||||
add allowSSH 66.174.255.128/26
|
|
||||||
add allowSSH 66.174.0.0/17
|
|
||||||
add allowSSH 66.174.248.0/22
|
|
||||||
add allowSSH 172.98.199.107
|
|
||||||
add allowSSH 69.103.252.0/23
|
|
||||||
add allowSSH 69.83.255.128/26
|
|
||||||
add allowSSH 149.28.123.155
|
|
||||||
add allowSSH 69.83.255.192/27
|
|
||||||
add allowSSH 69.83.255.240/29
|
|
||||||
add allowSSH 70.222.0.0/16
|
|
||||||
add allowSSH 70.223.255.240/29
|
|
||||||
add allowSSH 66.94.0.0/19
|
|
||||||
add allowSSH 66.174.240.0/21
|
|
||||||
add allowSSH 69.103.255.0/25
|
|
||||||
add allowSSH 174.255.255.252/31
|
|
||||||
add allowSSH 69.96.0.0/14
|
|
||||||
add allowSSH 97.255.255.240/29
|
|
||||||
add allowSSH 100.128.0.0/9
|
|
||||||
add allowSSH 70.223.224.0/20
|
|
||||||
add allowSSH 69.83.0.0/17
|
|
||||||
add allowSSH 69.103.255.240/29
|
|
||||||
add allowSSH 70.223.255.255
|
|
||||||
add allowSSH 149.28.42.0/23
|
|
||||||
add allowSSH 97.255.255.192/27
|
|
||||||
add allowSSH 97.255.252.0/23
|
|
||||||
add allowSSH 67.211.160.0/24
|
|
||||||
add allowSSH 69.100.0.0/15
|
|
||||||
add allowSSH 174.255.0.0/17
|
|
||||||
add allowSSH 69.83.224.0/20
|
|
||||||
add allowSSH 97.255.255.254
|
|
||||||
add allowSSH 97.192.0.0/11
|
|
||||||
add allowSSH 97.128.0.0/10
|
|
||||||
add allowSSH 69.83.192.0/19
|
|
||||||
add allowSSH 97.255.255.248/30
|
|
||||||
add allowSSH 66.174.255.224/28
|
|
||||||
add allowSSH 66.174.224.0/20
|
|
||||||
add allowSSH 174.192.0.0/11
|
|
||||||
add allowSSH 174.255.255.0/25
|
|
||||||
add allowSSH 97.255.255.128/26
|
|
||||||
add allowSSH 70.223.192.0/19
|
|
||||||
add allowSSH 66.174.255.255
|
|
||||||
add allowSSH 174.255.255.224/28
|
|
||||||
add allowSSH 162.248.242.96/29
|
|
||||||
add allowSSH 97.255.248.0/22
|
|
||||||
add allowSSH 97.255.224.0/20
|
|
||||||
create directHTTPS hash:net family inet hashsize 1024 maxelem 65536
|
|
||||||
add directHTTPS 67.211.160.100
|
|
||||||
add directHTTPS 72.241.86.95
|
|
||||||
add directHTTPS 72.240.75.15
|
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
# Generated by iptables-save v1.4.21 on Sat May 13 10:34:33 2017
|
||||||
|
*filter
|
||||||
|
:INPUT ACCEPT [59:5736]
|
||||||
|
:FORWARD ACCEPT [0:0]
|
||||||
|
:OUTPUT ACCEPT [45:49826]
|
||||||
|
|
||||||
|
-A INPUT -m set --match-set drop src -j DROP
|
||||||
|
-A OUTPUT -m set --match-set drop dst -j DROP
|
||||||
|
|
||||||
|
COMMIT
|
||||||
|
# Completed on Sat May 13 10:34:33 2017
|
||||||
|
|
@ -0,0 +1,65 @@
|
||||||
|
#!/bin/bash
|
||||||
|
# Configure iptables firewall
|
||||||
|
|
||||||
|
# Limit PATH
|
||||||
|
PATH="/sbin:/usr/sbin:/bin:/usr/bin"
|
||||||
|
|
||||||
|
# Download
|
||||||
|
ip_update() {
|
||||||
|
wget -q 'https://www.cloudflare.com/ips-v4' -O /etc/iptables/list/CF.list
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/ru.zone' -O /etc/iptables/zone/ru.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/cn.zone' -O /etc/iptables/zone/cn.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/in.zone' -O /etc/iptables/zone/in.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/iq.zone' -O /etc/iptables/zone/iq.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/jp.zone' -O /etc/iptables/zone/jp.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/kp.zone' -O /etc/iptables/zone/kp.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/kr.zone' -O /etc/iptables/zone/kr.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/id.zone' -O /etc/iptables/zone/id.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/cf.zone' -O /etc/iptables/zone/cf.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/za.zone' -O /etc/iptables/zone/za.zone
|
||||||
|
wget -q 'http://ipdeny.com/ipblocks/data/countries/co.zone' -O /etc/iptables/zone/co.zone
|
||||||
|
}
|
||||||
|
# ipset update
|
||||||
|
firewall_update() {
|
||||||
|
ip_update
|
||||||
|
for i in $(cat /etc/iptables/zone/*.zone ); do ipset -exist -A drop $i; done
|
||||||
|
}
|
||||||
|
|
||||||
|
# iptables configuration
|
||||||
|
firewall_start() {
|
||||||
|
ipset create drop hash:net family inet hashsize 16384 maxelem 65536
|
||||||
|
ip_update
|
||||||
|
for i in $(cat /etc/iptables/zone/*.zone ); do ipset -exist -A drop $i; done
|
||||||
|
iptables -A INPUT -m set --match-set drop src -j DROP
|
||||||
|
iptables -A OUTPUT -m set --match-set drop dst -j DROP
|
||||||
|
}
|
||||||
|
|
||||||
|
# clear iptables configuration
|
||||||
|
firewall_stop() {
|
||||||
|
iptables -F
|
||||||
|
iptables -X
|
||||||
|
iptables -P INPUT ACCEPT
|
||||||
|
iptables -P FORWARD ACCEPT
|
||||||
|
iptables -P OUTPUT ACCEPT
|
||||||
|
ipset destroy drop
|
||||||
|
}
|
||||||
|
|
||||||
|
# execute action
|
||||||
|
case "$1" in
|
||||||
|
start|restart)
|
||||||
|
echo "Starting firewall"
|
||||||
|
firewall_stop
|
||||||
|
firewall_start
|
||||||
|
echo "Firewall started"
|
||||||
|
;;
|
||||||
|
stop)
|
||||||
|
echo "Stopping firewall"
|
||||||
|
firewall_stop
|
||||||
|
echo "Firewall stopped"
|
||||||
|
;;
|
||||||
|
update)
|
||||||
|
echo "Update ipset IPs"
|
||||||
|
firewall_update
|
||||||
|
echo "updated ipset IPs"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
[Unit]
|
||||||
|
Description=iptables firewall service
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=/etc/iptables/service.sh start
|
||||||
|
RemainAfterExit=true
|
||||||
|
ExecStop=/etc/iptables/service.sh stop
|
||||||
|
StandardOutput=journal
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
103.21.244.0/22
|
|
||||||
103.22.200.0/22
|
|
||||||
103.31.4.0/22
|
|
||||||
104.16.0.0/12
|
|
||||||
108.162.192.0/18
|
|
||||||
131.0.72.0/22
|
|
||||||
141.101.64.0/18
|
|
||||||
162.158.0.0/15
|
|
||||||
172.64.0.0/13
|
|
||||||
173.245.48.0/20
|
|
||||||
188.114.96.0/20
|
|
||||||
190.93.240.0/20
|
|
||||||
197.234.240.0/22
|
|
||||||
198.41.128.0/17
|
|
||||||
|
|
@ -1,129 +0,0 @@
|
||||||
72.240.0.0/15
|
|
||||||
67.211.160.0/24
|
|
||||||
66.174.0.0/17
|
|
||||||
66.174.128.0/18
|
|
||||||
66.174.192.0/19
|
|
||||||
66.174.224.0/20
|
|
||||||
66.174.240.0/21
|
|
||||||
66.174.248.0/22
|
|
||||||
66.174.252.0/23
|
|
||||||
66.174.254.0/24
|
|
||||||
66.174.255.0/25
|
|
||||||
66.174.255.128/26
|
|
||||||
66.174.255.192/27
|
|
||||||
66.174.255.224/28
|
|
||||||
66.174.255.240/29
|
|
||||||
66.174.255.248/30
|
|
||||||
66.174.255.252/31
|
|
||||||
66.174.255.254/32
|
|
||||||
66.174.255.255/32
|
|
||||||
69.82.0.0/16
|
|
||||||
69.83.0.0/17
|
|
||||||
69.83.128.0/18
|
|
||||||
69.83.192.0/19
|
|
||||||
69.83.224.0/20
|
|
||||||
69.83.240.0/21
|
|
||||||
69.83.248.0/22
|
|
||||||
69.83.252.0/23
|
|
||||||
69.83.254.0/24
|
|
||||||
69.83.255.0/25
|
|
||||||
69.83.255.128/26
|
|
||||||
69.83.255.192/27
|
|
||||||
69.83.255.224/28
|
|
||||||
69.83.255.240/29
|
|
||||||
69.83.255.248/30
|
|
||||||
69.83.255.252/31
|
|
||||||
69.83.255.254/32
|
|
||||||
69.83.255.255/32
|
|
||||||
69.96.0.0/14
|
|
||||||
69.100.0.0/15
|
|
||||||
69.102.0.0/16
|
|
||||||
69.103.0.0/17
|
|
||||||
69.103.128.0/18
|
|
||||||
69.103.192.0/19
|
|
||||||
69.103.224.0/20
|
|
||||||
69.103.240.0/21
|
|
||||||
69.103.248.0/22
|
|
||||||
69.103.252.0/23
|
|
||||||
69.103.254.0/24
|
|
||||||
69.103.255.0/25
|
|
||||||
69.103.255.128/26
|
|
||||||
69.103.255.192/27
|
|
||||||
69.103.255.224/28
|
|
||||||
69.103.255.240/29
|
|
||||||
69.103.255.248/30
|
|
||||||
69.103.255.252/31
|
|
||||||
69.103.255.254/32
|
|
||||||
69.103.255.255/32
|
|
||||||
70.192.0.0/12
|
|
||||||
70.208.0.0/13
|
|
||||||
70.216.0.0/14
|
|
||||||
70.220.0.0/15
|
|
||||||
70.222.0.0/16
|
|
||||||
70.223.0.0/17
|
|
||||||
70.223.128.0/18
|
|
||||||
70.223.192.0/19
|
|
||||||
70.223.224.0/20
|
|
||||||
70.223.240.0/21
|
|
||||||
70.223.248.0/22
|
|
||||||
70.223.252.0/23
|
|
||||||
70.223.254.0/24
|
|
||||||
70.223.255.0/25
|
|
||||||
70.223.255.128/26
|
|
||||||
70.223.255.192/27
|
|
||||||
70.223.255.224/28
|
|
||||||
70.223.255.240/29
|
|
||||||
70.223.255.248/30
|
|
||||||
70.223.255.252/31
|
|
||||||
70.223.255.254/32
|
|
||||||
70.223.255.255/32
|
|
||||||
97.128.0.0/10
|
|
||||||
97.192.0.0/11
|
|
||||||
97.224.0.0/12
|
|
||||||
97.240.0.0/13
|
|
||||||
97.248.0.0/14
|
|
||||||
97.252.0.0/15
|
|
||||||
97.254.0.0/16
|
|
||||||
97.255.0.0/17
|
|
||||||
97.255.128.0/18
|
|
||||||
97.255.192.0/19
|
|
||||||
97.255.224.0/20
|
|
||||||
97.255.240.0/21
|
|
||||||
97.255.248.0/22
|
|
||||||
97.255.252.0/23
|
|
||||||
97.255.254.0/24
|
|
||||||
97.255.255.0/25
|
|
||||||
97.255.255.128/26
|
|
||||||
97.255.255.192/27
|
|
||||||
97.255.255.224/28
|
|
||||||
97.255.255.240/29
|
|
||||||
97.255.255.248/30
|
|
||||||
97.255.255.252/31
|
|
||||||
97.255.255.254/32
|
|
||||||
97.255.255.255/32
|
|
||||||
174.192.0.0/11
|
|
||||||
174.224.0.0/12
|
|
||||||
174.240.0.0/13
|
|
||||||
174.248.0.0/14
|
|
||||||
174.252.0.0/15
|
|
||||||
174.254.0.0/16
|
|
||||||
174.255.0.0/17
|
|
||||||
174.255.128.0/18
|
|
||||||
174.255.192.0/19
|
|
||||||
174.255.224.0/20
|
|
||||||
174.255.240.0/21
|
|
||||||
174.255.248.0/22
|
|
||||||
174.255.252.0/23
|
|
||||||
174.255.254.0/24
|
|
||||||
174.255.255.0/25
|
|
||||||
174.255.255.128/26
|
|
||||||
174.255.255.192/27
|
|
||||||
174.255.255.224/28
|
|
||||||
174.255.255.240/29
|
|
||||||
174.255.255.248/30
|
|
||||||
174.255.255.252/31
|
|
||||||
174.255.255.254/32
|
|
||||||
174.255.255.255/32
|
|
||||||
149.28.43.193/23
|
|
||||||
45.76.15.216/32
|
|
||||||
162.248.242.98/29
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
72.241.86.95
|
|
||||||
67.211.160.100
|
|
||||||
53
rules.v4
53
rules.v4
|
|
@ -1,53 +0,0 @@
|
||||||
# Generated by iptables-save v1.4.21 on Sat May 13 10:34:33 2017
|
|
||||||
*filter
|
|
||||||
:INPUT DROP [59:5736]
|
|
||||||
:FORWARD DROP [0:0]
|
|
||||||
:OUTPUT ACCEPT [45:49826]
|
|
||||||
|
|
||||||
-A INPUT -m set --match-set drop src -j DROP
|
|
||||||
-A OUTPUT -m set --match-set drop dst -j DROP
|
|
||||||
|
|
||||||
-A INPUT -p ICMP --icmp-type 8 -j ACCEPT
|
|
||||||
|
|
||||||
-A INPUT -m state --state INVALID -j DROP
|
|
||||||
-A FORWARD -m state --state INVALID -j DROP
|
|
||||||
##-A OUTPUT -m state --state INVALID -j DROP
|
|
||||||
|
|
||||||
-A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT
|
|
||||||
|
|
||||||
-A INPUT -m recent --name portscan --rcheck --second 86400 -j DROP
|
|
||||||
-A FORWARD -m recent --name portscan --rcheck --second 86400 -j DROP
|
|
||||||
|
|
||||||
-A INPUT -m recent --name portscan --remove
|
|
||||||
-A FORWARD -m recent --name portscan --remove
|
|
||||||
|
|
||||||
-A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
|
|
||||||
-A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
|
|
||||||
|
|
||||||
-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
|
|
||||||
-A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
|
|
||||||
#### END DROP INVALID DATA 20180408 ####
|
|
||||||
|
|
||||||
-A INPUT -i lo -j ACCEPT
|
|
||||||
|
|
||||||
#-A INPUT -p tcp --dport 22333 -i ztwfuerpaw -j ACCEPT
|
|
||||||
|
|
||||||
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
||||||
|
|
||||||
#-A INPUT -m set --match-set allowHTTPS src -p tcp -m tcp --dport 443 -j ACCEPT
|
|
||||||
#-A INPUT -m set --match-set directHTTPS src -p tcp -m tcp --dport 443 -j ACCEPT
|
|
||||||
|
|
||||||
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
|
|
||||||
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
|
|
||||||
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
|
|
||||||
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
|
|
||||||
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
|
|
||||||
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
|
|
||||||
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
|
|
||||||
|
|
||||||
#-A OUTPUT -j ACCEPT
|
|
||||||
#-A FORWARD -j DROP
|
|
||||||
##-A INPUT -i eth0 -j DROP
|
|
||||||
#-A INPUT -j DROP
|
|
||||||
COMMIT
|
|
||||||
# Completed on Sat May 13 10:34:33 2017
|
|
||||||
22
update.sh
22
update.sh
|
|
@ -1,22 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/ru.zone' -O /etc/iptables/zone/ru.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/cn.zone' -O /etc/iptables/zone/cn.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/in.zone' -O /etc/iptables/zone/in.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/iq.zone' -O /etc/iptables/zone/iq.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/jp.zone' -O /etc/iptables/zone/jp.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/kp.zone' -O /etc/iptables/zone/kp.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/kr.zone' -O /etc/iptables/zone/kr.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/id.zone' -O /etc/iptables/zone/id.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/cf.zone' -O /etc/iptables/zone/cf.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/za.zone' -O /etc/iptables/zone/za.zone
|
|
||||||
wget -q 'http://ipdeny.com/ipblocks/data/countries/co.zone' -O /etc/iptables/zone/co.zone
|
|
||||||
wget -q 'https://www.cloudflare.com/ips-v4' -O /etc/iptables/list/CF.list
|
|
||||||
|
|
||||||
|
|
||||||
for i in $(cat /etc/iptables/zone/*.zone ); do ipset -exist -A drop $i; done
|
|
||||||
for i in $(cat /etc/iptables/list/CF.list ); do ipset -exist -A allowHTTPS $i; done
|
|
||||||
for i in $(cat /etc/iptables/list/allowSSH.list ); do ipset -exist -A allowSSH $i; done
|
|
||||||
for i in $(cat /etc/iptables/list/directHTTPS.list ); do ipset -exist -A directHTTPS $i; done
|
|
||||||
|
|
||||||
ipset save > /etc/iptables/ipset.save
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
blockedIPhere/32
|
|
||||||
Loading…
Reference in New Issue