1

I need to block some countries using ipset and iptables.

What I've done so far (create new ipset set 'geoblock'):

sudo ipset create geoblock hash:net,port

then I created the following script /usr/sbin/ipsetfirewall.sh

#!/bin/bash
for IP in $(wget -O – http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone)
do
# ban everything – block countryX
sudo ipset add geoblock $IP
done

As explained here I also tried:

wget -O – http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone --header "Referer: www.ipdeny.com"

and I tried this too (since I'm using ipv4)

wget -4 http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone

For all my tries I get this same error:

/usr/sbin$ sudo sh ipsetfirewall.sh
--2016-04-21 15:40:58--  http://www.ipdeny.com/ipblocks/data/countries/%7Bcn,iq,af,ir,ae,sg,hk,kw,kg%7D.zone
Resolving www.ipdeny.com (www.ipdeny.com)... 192.241.240.22
Connecting to www.ipdeny.com (www.ipdeny.com)|192.241.240.22|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2016-04-21 15:40:59 ERROR 404: Not Found.

What's the problem?

4
  • 1
    You're making an HTTP call to http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone which fails. You need to be making individual calls for each country in your for loop.
    – ceejayoz
    Apr 21, 2016 at 16:38
  • @ceejayoz Thanks, now I can download using wget but when I type sudo ipset list geoblock my set is still not populated Apr 21, 2016 at 17:13
  • 2
    add set -x as the first line of your script, and see exactly what is being executed? That will help you debug.
    – Zoredache
    Apr 21, 2016 at 17:45
  • Do you have brace expansion enabled?
    – Tomek
    Jul 23, 2018 at 6:59

3 Answers 3

3

Use this script:

for country in cn tw in
do
    ipset destroy geoblock-$country > /dev/null 2>&1
    ipset create geoblock-$country hash:net
    for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/$country.zone)
    do
        ipset add geoblock-$country $IP
    done
done
ipset save > /etc/ipset.rules
2

Probably more efficient to grab all the zones

wget http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
tar -xzf all-zones.tar.gz

Otherwise, one-at-a-time

for C in cn iq af ir ae sg hk kw kg ; do
   wget -4 http://www.ipdeny.com/ipblocks/data/countries/${C}.zone
done
0

This is the best guide I found so far.

https://mtxserv.com/vps-server/doc/how-to-block-ip-addresses-by-country

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .