1

In a separate file I'm creating a list of IP addresses to be blocked. This file will have IPs added in or removed on a daily basis. I want to "reference" this IP File into /etc/sysconfig/iptables, but I'm not sure if that is possible. If yes, please describe how to do that (ie: ExternalList=/var/tmp/myblacklist.txt) ???

If that type of reference isn't possible in IPTABLES, what would be a good script to add entries from myblacklist.txt into iptables and remove entries from iptables which no longer appear in the myblacklist.txt file?

I'm honestly looking for a simple bash script that might utilize sed. Otherwise, I think I'll trend down the road of putting all the IPs I want to allow/block into an MySQL table and just setting up a script to compile a new iptable on a daily basis. This way mods can be done in the sql DB and the iptables will just print whatever is in the DB. But before I choose that option, could I get away with some simple bash script?

0

You should investigate using the ipset module for this:

http://ipset.netfilter.org/

Simply add all the IP addresses into a set, and then setup a single iptables rule which drops/rejects packets against that set.

Also easy to manage as you can add, remove and empty the set easily, and generally modify it "on the fly", as and when required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.