Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to block all countries except mine in iptables, that is a list with about 100.000 Entries.

How can I define this blacklist file in a script, so iptables blocks all those IP ranges?

Maybe I can use: that provides lists in the form

I want to be able to change the blacklistfile easily without having to change the iptables-script.

share|improve this question
This is usually a bad idea. What are you really wanting to do? – Michael Hampton Sep 13 '12 at 14:33
It would take ages to load, a better approach would be to DENY by default and ACCEPT for the of your country. Just remember that the ips change continuously, so an ip that is from Deutschland today, might be Greek tomorrow, also new ips are assigned every day. – Aseques Sep 13 '12 at 14:37
i think this script is quite useful: – rubo77 Sep 14 '12 at 0:19
Wouldn't it be already really effective, if I block the biggest networks with /8 at the mask? Then I would have only 100 rules and would block 1.6 Billion IPs already ;) – rubo77 Sep 14 '12 at 0:21

Take a look at ipset I think this is exactly what you are looking for. ipset extension

share|improve this answer
sounds good, but how do i set this up on ubuntu 12.04.1? this seems, like what i need, but i get errors installing it without the (in 12.04 removed) package ipset-source:… – rubo77 Sep 14 '12 at 0:43
I asked another question for that:… – rubo77 Sep 14 '12 at 0:52
Are you sure ? I installed ipset on my 12.04 without any problem. – hostmaster Sep 14 '12 at 7:05

Blocking by country is certainly a very bad idea but there is a geoip module for Netfilter which is probably the simplest solution.

share|improve this answer
Has anyone tried this lately and any experiences with it? – rubo77 Jun 26 '13 at 5:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.