I need to block some countries using ipset and iptables.

What I've done so far (create new ipset set 'geoblock'):

sudo ipset create geoblock hash:net,port

then I created the following script /usr/sbin/ipsetfirewall.sh

for IP in $(wget -O – http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone)
# ban everything – block countryX
sudo ipset add geoblock $IP

As explained here I also tried:

wget -O – http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone --header "Referer: www.ipdeny.com"

and I tried this too (since I'm using ipv4)

wget -4 http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone

For all my tries I get this same error:

/usr/sbin$ sudo sh ipsetfirewall.sh
--2016-04-21 15:40:58--  http://www.ipdeny.com/ipblocks/data/countries/%7Bcn,iq,af,ir,ae,sg,hk,kw,kg%7D.zone
Resolving www.ipdeny.com (www.ipdeny.com)...
Connecting to www.ipdeny.com (www.ipdeny.com)||:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2016-04-21 15:40:59 ERROR 404: Not Found.

What's the problem?

  • 1
    You're making an HTTP call to http://www.ipdeny.com/ipblocks/data/countries/{cn,iq,af,ir,ae,sg,hk,kw,kg}.zone which fails. You need to be making individual calls for each country in your for loop. – ceejayoz Apr 21 '16 at 16:38
  • @ceejayoz Thanks, now I can download using wget but when I type sudo ipset list geoblock my set is still not populated – NineCattoRules Apr 21 '16 at 17:13
  • 2
    add set -x as the first line of your script, and see exactly what is being executed? That will help you debug. – Zoredache Apr 21 '16 at 17:45
  • Do you have brace expansion enabled? – Tomek Jul 23 '18 at 6:59

Probably more efficient to grab all the zones

wget http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
tar -xzf all-zones.tar.gz

Otherwise, one-at-a-time

for C in cn iq af ir ae sg hk kw kg ; do
   wget -4 http://www.ipdeny.com/ipblocks/data/countries/${C}.zone

Use this script:

for country in cn tw in
    ipset destroy geoblock-$country > /dev/null 2>&1
    ipset create geoblock-$country hash:net
    for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/$country.zone)
        ipset add geoblock-$country $IP
ipset save > /etc/ipset.rules

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.