Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

how I can block a whole host (internet provider), or allow only one country for ssh login?

share|improve this question

migrated from stackoverflow.com Jun 13 '10 at 17:36

This question came from our site for professional and enthusiast programmers.

3 Answers 3

1.) Lookup the IP addresses of a specific ISP:

You'll have to use Google and search WHOIS records. You can also get hold of an ip2location database which should help.

2.) The command you need is: $ iptables -A INPUT -s 192.168.100.0/24 -j DROP

Replace the IP (192.168.100.0) with your start IP of the range to block and the number afterwards with a netmask (see: http://www.computerhope.com/jargon/n/netmask.htm to work out what number you need) depending on how far you want to go, block-wise.

share|improve this answer

iptables GeoIP extension allows you to create rules matching by country. Unfortunately GeoIP is not part of standard iptables/netfilter, so you need to hack around a bit to get it enabled.

Here's a tutorial for Debian 5.0.

share|improve this answer

In blogama you can pick the country you'd like to block. (i.e)

CN China

Now, if you want to get the whole IP range for China, just query in the following address

http://blogama.org/country_query.php?country=CN 

I found this a little bit tedious, so I made a script:

    #!/usr/bin/env ruby

    %w(uri net/http optparse).each {|r| require r}

    options = {}

    optparser = OptionParser.new do |opts|

      opts.banner = "Usage: #{File.basename($0)} [options]"
      opts.on('-c','--country COUNTRY', 'Country to generate iptables rules ie: CH') do |f|
        options[:country] = f
      end

      options[:list] = false
      opts.on('-l','--list', ' List all countries') do |r|
          options[:list] = true
      end

      opts.on_tail('-h','--help', 'Show options') do |o|
        puts opts
        exit
      end

    end

    optparser.parse(ARGV)

    if ARGV.length == 0
      puts optparser
      exit
    end

    url = 'http://blogama.org/country.txt'
    list = Net::HTTP.get(URI.parse(url))

    if options[:list]
      puts list
      exit
    end

    query = 'http://blogama.org/country_query.php?country=' + options[:country]

    Dir.mkdir("blocked") if ! File.directory?("blocked")
    f = File.open("blocked/" + options[:country] + ".block","w")

    range = Net::HTTP.get(URI.parse(query))
    ips = range.split(/\n/)
    ips.each do |ip|
      rule = "iptables -A INPUT #{ip} -j DROP\n"
      f.write(rule)
    end

The script will generate a list with the iptables syntax, based on the country you picked.Afterwards you can add that file to your rules

# Blocked IP range
. ./ipblock

Caveat: Too many rules will make you connection slower because the incoming packets will be matched against every rule you added.

share|improve this answer
    
blogama.org is now a parked domain. this could be a good alternative: ipinfodb.com/ip_country_block_iptables.php –  booyaa Dec 7 '11 at 12:31
    
thanks for the info, I did not know it. –  Sergio Galvan Dec 9 '11 at 12:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.