my goal is to drop with iptables more or less every request from non-german countries.
the best solution that is working in 2022 is this five year old script.
(Source: https://www.cyberciti.biz/faq/block-entier-country-using-iptables/)
with the help of this script-template and some iptables tutorials I'm able to allow (more or less accurate) only German IP-Ranges.
This is my modified script: (it's not optimized yet, but should block every non-german IP-Requests)
ISO="de"
IPT=/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep
SPAMLIST="countrydrop"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT
$IPT -F
$IPT -N $SPAMLIST
for c in $ISO
do
tDB=$ZONEROOT/$c.zone
$WGET -O $tDB $DLROOT/$c.zone
BADIPS=$(egrep -v "^#|^$" $tDB)
for ipblock in $BADIPS
do
$IPT -A $SPAMLIST ! -s $ipblock -j DROP
done
done
exit 0
but if I let the script run, it creates the rule and then I want to make the default rule "incoming traffic" to drop, he locks me instantly out.
I know, IP tables is processing the rules from top to button, but now I'm not sure how to handle it in the script.
Or do I don't need to make the default incoming chain/rule to block everything, because I already blocked everything except German IP Adresses? Or should I put the default drop on top of the script? this is how I'd edit the default incoming rule:
iptables --policy INPUT DROP
... but it feels kinda bad, if I let the default incoming rule untouched .. what do you think?
in the end I'd like to:
- block everything by default
- except German IP Adresses
- and open about ~5 ports (only for German IP-Adresses)
If I could handle this in only one script, that's always running on boot, I'd be really happy! :-)
P.S: I'm sure, I'm not the only one who is looking for a up2date solution for this task, it would be awesome if some people could help to find a solution for this case :-)
sudo iptables -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPTrule first in your INPUT chain. where$EXTIFis your network interface card name. You also need aloACCEPT rule,sudo iptables -A INPUT -i lo -j ACCEPT. Myself, I would use ipset to do what you are attempting. I would also ACCEPT packets from Germany, and let the others fall to the default DROP rule, as it'll be more efficient. – Doug Smythies Jun 03 '22 at 15:48$IPT -A $SPAMLIST ! -s $ipblock -j DROPshould be this$IPT -A $SPAMLIST -s $ipblock -j ACCEPT. There are other issues, but I'll have to come back to it later. – Doug Smythies Jun 03 '22 at 20:38$IPT --policy INPUT DROP$IPT -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT$IPT -A INPUT -i lo -j ACCEPT... to my script, but I can still access or ping my VPS from different locations :/ I guess this topic is kinda complicated. I found this script-template https://github.com/mkorthof/ipset-country which should be the perfect solution for everyone with this problem- but even this script doesn't work that well. If you still have an idea, how to solve this kinda shortly with my script, let me know
– ubuntu4life Jun 03 '22 at 22:23