I need to block some countries using ipset and iptables.
What I've done so far (create new ipset set 'geoblock'):
sudo ipset create geoblock hash:net,port
then I created the following script /usr/sbin/ipsetfirewall.sh
#!/bin/bash
for IP in $(wget -O – http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone)
do
# ban everything – block countryX
sudo ipset add geoblock $IP
done
As explained here I also tried:
wget -O – http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone --header "Referer: www.ipdeny.com"
and I tried this too (since I'm using ipv4)
wget -4 http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone
For all my tries I get this same error:
/usr/sbin$ sudo sh ipsetfirewall.sh
--2016-04-21 15:40:58-- http://www.ipdeny.com/ipblocks/data/countries/%7Bcn,iq,af,ir,ae,sg,hk,kw,kg%7D.zone
Resolving www.ipdeny.com (www.ipdeny.com)... 192.241.240.22
Connecting to www.ipdeny.com (www.ipdeny.com)|192.241.240.22|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2016-04-21 15:40:59 ERROR 404: Not Found.
What's the problem?
http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone
which fails. You need to be making individual calls for each country in your for loop.sudo ipset list geoblock
my set is still not populatedset -x
as the first line of your script, and see exactly what is being executed? That will help you debug.