Iptables block host

Question

how I can block a whole host (internet provider), or allow only one country for ssh login?

Answer 1

1.) Lookup the IP addresses of a specific ISP:

You'll have to use Google and search WHOIS records. You can also get hold of an ip2location database which should help.

2.) The command you need is: $ iptables -A INPUT -s 192.168.100.0/24 -j DROP

Replace the IP (192.168.100.0) with your start IP of the range to block and the number afterwards with a netmask (see: http://www.computerhope.com/jargon/n/netmask.htm to work out what number you need) depending on how far you want to go, block-wise.

Answer 2

iptables GeoIP extension allows you to create rules matching by country. Unfortunately GeoIP is not part of standard iptables/netfilter, so you need to hack around a bit to get it enabled.

Here's a tutorial for Debian 5.0.

Answer 3

In blogama you can pick the country you'd like to block. (i.e)

CN China

Now, if you want to get the whole IP range for China, just query in the following address

http://blogama.org/country_query.php?country=CN 

I found this a little bit tedious, so I made a script:

    #!/usr/bin/env ruby

    %w(uri net/http optparse).each {|r| require r}

    options = {}

    optparser = OptionParser.new do |opts|

      opts.banner = "Usage: #{File.basename($0)} [options]"
      opts.on('-c','--country COUNTRY', 'Country to generate iptables rules ie: CH') do |f|
        options[:country] = f
      end

      options[:list] = false
      opts.on('-l','--list', ' List all countries') do |r|
          options[:list] = true
      end

      opts.on_tail('-h','--help', 'Show options') do |o|
        puts opts
        exit
      end

    end

    optparser.parse(ARGV)

    if ARGV.length == 0
      puts optparser
      exit
    end

    url = 'http://blogama.org/country.txt'
    list = Net::HTTP.get(URI.parse(url))

    if options[:list]
      puts list
      exit
    end

    query = 'http://blogama.org/country_query.php?country=' + options[:country]

    Dir.mkdir("blocked") if ! File.directory?("blocked")
    f = File.open("blocked/" + options[:country] + ".block","w")

    range = Net::HTTP.get(URI.parse(query))
    ips = range.split(/\n/)
    ips.each do |ip|
      rule = "iptables -A INPUT #{ip} -j DROP\n"
      f.write(rule)
    end

The script will generate a list with the iptables syntax, based on the country you picked.Afterwards you can add that file to your rules

# Blocked IP range
. ./ipblock

Caveat: Too many rules will make you connection slower because the incoming packets will be matched against every rule you added.