I get an absolute battering from China on a daily basis with the occasional attack from France, Germany or the US. \u00a0Time to block countries :)<\/p>\n
First and foremost, make sure you have iptables installed, configured and working.
\nNext we'll install some additions:<\/p>\n
emerge -av\u00a0xtables-addons\u00a0geoipupdate<\/pre>\nYou may need to remove some of the modules to allow xtables to install (depends on your setup). \u00a0This can be achieved by adding the following line to\u00a0\/etc\/portage\/make.conf:<\/p>\n
XTABLES_ADDONS=\"=account =chaos =condition =delude =dhcpmac =fuzzy geoip =iface =ipmark =ipp2p =ipv4options =length2 =logmark =lscan =pknock =psd =quota2 =rawnat =steal =sysrq =tarpit =dnetmap =echo =gradm\"<\/pre>\nI'm only interested in geoip, so I removed everything else.<\/p>\n
Make the directory where iptables will look for the database:<\/p>\n
mkdir -p \/usr\/share\/xt_geoip\/<\/pre>\nExecute the following to download the geoiplite databases:<\/p>\n
If you have a paid account, you could potentially replace the URLs in the download script (untested)<\/p>\n
cd \/usr\/share\/xt_geoip\/ && \/lib64\/xtables-addons\/xt_geoip_dl && \/lib64\/xtables-addons\/xt_geoip_build *.csv<\/pre>\nYou could cron this as a weekly update.<\/p>\n
xt_geoip_dl: Downloads the CSV database files
\nxt_geoip_build: Processes the files into a format iptables can read.<\/p>\n\/usr\/share\/xt_geoip\/LE\/<country abbreviation>.iv4 & .iv6<\/p>\n
Now you can block countries using iptables<\/p>\n
iptables -A INPUT -m geoip --src-cc CN -j DROP<\/pre>\nAn\u00a0iptables -L -n<\/strong> will show<\/p>\n
DROP all -- 0.0.0.0\/0 0.0.0.0\/0 -m geoip --source-country CN<\/pre>\n<\/p>\n","protected":false},"excerpt":{"rendered":"
I get an absolute battering from China on a daily basis with the occasional attack from France, Germany or the US. \u00a0Time to block countries :) First and foremost, make sure you have iptables installed, configured and working. Next we'll install some additions: emerge -av\u00a0xtables-addons\u00a0geoipupdate You may need to remove some of the modules to … Continue reading Block countries with IPTables<\/span>