change to iptables
This commit is contained in:
nnduc
13
iptables/china-block.service
Normal file
13
iptables/china-block.service
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Block Chinese IP ranges via ipset + iptables
|
||||||
|
After=network-online.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
ExecStart=/usr/local/sbin/china-block.sh
|
||||||
|
ExecStop=/usr/local/sbin/china-unblock.sh
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
86
iptables/china-block.sh
Executable file
86
iptables/china-block.sh
Executable file
@@ -0,0 +1,86 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
IPSET_NAME="china"
|
||||||
|
CIDR_FILE="/tmp/cn.cidr"
|
||||||
|
|
||||||
|
SOURCES=(
|
||||||
|
"https://www.ipdeny.com/ipblocks/data/countries/cn.zone"
|
||||||
|
"https://raw.githubusercontent.com/mayaxcn/china-ip-list/master/chnroute.txt"
|
||||||
|
)
|
||||||
|
|
||||||
|
echo "[*] Killing Steam..."
|
||||||
|
pkill -9 -f steam || true
|
||||||
|
|
||||||
|
echo "[*] Downloading CN IP ranges..."
|
||||||
|
for url in "${SOURCES[@]}"; do
|
||||||
|
echo " Trying $url ..."
|
||||||
|
wget -q "$url" -O "$CIDR_FILE"
|
||||||
|
if [[ $(wc -l < "$CIDR_FILE") -gt 10 ]]; then
|
||||||
|
echo " [+] Success: $(wc -l < "$CIDR_FILE") entries"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ $(wc -l < "$CIDR_FILE") -lt 10 ]]; then
|
||||||
|
echo "[!] All sources failed. Aborting."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[*] Creating ipset..."
|
||||||
|
ipset create "$IPSET_NAME" hash:net 2>/dev/null || ipset flush "$IPSET_NAME"
|
||||||
|
|
||||||
|
echo "[*] Populating ipset..."
|
||||||
|
while IFS= read -r cidr; do
|
||||||
|
[[ -z "$cidr" || "$cidr" == \#* ]] && continue
|
||||||
|
ipset add "$IPSET_NAME" "$cidr" || true
|
||||||
|
done < "$CIDR_FILE"
|
||||||
|
|
||||||
|
echo "[*] Applying iptables rules..."
|
||||||
|
iptables -A INPUT -m set --match-set "$IPSET_NAME" src -j DROP
|
||||||
|
iptables -A OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP
|
||||||
|
|
||||||
|
echo "[*] Applying raw table rules (block UDP hole punch)..."
|
||||||
|
iptables -t raw -A PREROUTING -m set --match-set "$IPSET_NAME" src -j DROP
|
||||||
|
iptables -t raw -A OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP
|
||||||
|
|
||||||
|
CIDR6_FILE="/tmp/cn6.cidr"
|
||||||
|
SOURCES6=(
|
||||||
|
"https://raw.githubusercontent.com/herrbischoff/country-ip-blocks/master/ipv6/cn.cidr"
|
||||||
|
"https://www.ipdeny.com/ipv6/ipaddresses/blocks/cn.cidr"
|
||||||
|
)
|
||||||
|
|
||||||
|
echo "[*] Downloading CN IPv6 ranges..."
|
||||||
|
for url in "${SOURCES6[@]}"; do
|
||||||
|
echo " Trying $url ..."
|
||||||
|
wget -q "$url" -O "$CIDR6_FILE"
|
||||||
|
if [[ $(wc -l < "$CIDR6_FILE") -gt 10 ]]; then
|
||||||
|
echo " [+] Success: $(wc -l < "$CIDR6_FILE") entries"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ $(wc -l < "$CIDR6_FILE") -lt 10 ]]; then
|
||||||
|
echo "[!] All IPv6 sources failed. Skipping IPv6 blocking."
|
||||||
|
else
|
||||||
|
ipset create china6 hash:net family inet6 2>/dev/null || ipset flush china6
|
||||||
|
while IFS= read -r cidr; do
|
||||||
|
[[ -z "$cidr" || "$cidr" == \#* ]] && continue
|
||||||
|
ipset add china6 "$cidr" || true
|
||||||
|
done < "$CIDR6_FILE"
|
||||||
|
|
||||||
|
ip6tables -A INPUT -m set --match-set china6 src -j DROP
|
||||||
|
ip6tables -A OUTPUT -m set --match-set china6 dst -j DROP
|
||||||
|
ip6tables -t raw -A PREROUTING -m set --match-set china6 src -j DROP
|
||||||
|
ip6tables -t raw -A OUTPUT -m set --match-set china6 dst -j DROP
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[*] Saving rules..."
|
||||||
|
mkdir -p /etc/iptables
|
||||||
|
ipset save > /etc/ipset.conf
|
||||||
|
iptables-save > /etc/iptables/iptables.rules
|
||||||
|
ip6tables-save > /etc/iptables/ip6tables.rules
|
||||||
|
systemctl enable --now iptables
|
||||||
|
systemctl enable --now ip6tables 2>/dev/null || true
|
||||||
|
|
||||||
|
echo "[+] Done! Chinese IPs are now blocked."
|
||||||
28
iptables/china-unblock.sh
Executable file
28
iptables/china-unblock.sh
Executable file
@@ -0,0 +1,28 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
IPSET_NAME="china"
|
||||||
|
|
||||||
|
echo "[*] Removing iptables rules..."
|
||||||
|
iptables -D INPUT -m set --match-set "$IPSET_NAME" src -j DROP 2>/dev/null || true
|
||||||
|
iptables -D OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP 2>/dev/null || true
|
||||||
|
|
||||||
|
echo "[*] Removing raw table rules..."
|
||||||
|
iptables -t raw -D PREROUTING -m set --match-set "$IPSET_NAME" src -j DROP 2>/dev/null || true
|
||||||
|
iptables -t raw -D OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP 2>/dev/null || true
|
||||||
|
|
||||||
|
echo "[*] Removing ip6tables rules..."
|
||||||
|
ip6tables -D INPUT -m set --match-set china6 src -j DROP 2>/dev/null || true
|
||||||
|
ip6tables -D OUTPUT -m set --match-set china6 dst -j DROP 2>/dev/null || true
|
||||||
|
ip6tables -t raw -D PREROUTING -m set --match-set china6 src -j DROP 2>/dev/null || true
|
||||||
|
ip6tables -t raw -D OUTPUT -m set --match-set china6 dst -j DROP 2>/dev/null || true
|
||||||
|
|
||||||
|
echo "[*] Destroying ipsets..."
|
||||||
|
ipset destroy "$IPSET_NAME" 2>/dev/null || true
|
||||||
|
ipset destroy china6 2>/dev/null || true
|
||||||
|
rm -f /etc/ipset.conf /tmp/cn.cidr /tmp/cn6.cidr
|
||||||
|
|
||||||
|
echo "[*] Clearing saved rules..."
|
||||||
|
rm -f /etc/iptables/iptables.rules /etc/iptables/ip6tables.rules
|
||||||
|
|
||||||
|
echo "[+] Done! Chinese IPs are now unblocked."
|
||||||
10
iptables/install.sh
Normal file
10
iptables/install.sh
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
install -m 755 china-block.sh /usr/local/sbin/china-block.sh
|
||||||
|
install -m 755 china-unblock.sh /usr/local/sbin/china-unblock.sh
|
||||||
|
install -m 644 china-block.service /etc/systemd/system/china-block.service
|
||||||
|
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable --now china-block
|
||||||
|
echo "[+] china-block service installed and started."
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
IPSET_NAME="china"
|
|
||||||
CIDR_FILE="/tmp/cn.cidr"
|
|
||||||
UFW_RULE="/etc/ufw/applications.d/block-china"
|
|
||||||
|
|
||||||
SOURCES=(
|
|
||||||
"https://www.ipdeny.com/ipblocks/data/countries/cn.zone"
|
|
||||||
"https://raw.githubusercontent.com/mayaxcn/china-ip-list/master/chnroute.txt"
|
|
||||||
)
|
|
||||||
|
|
||||||
echo "[*] Downloading CN IP ranges..."
|
|
||||||
for url in "${SOURCES[@]}"; do
|
|
||||||
echo " Trying $url ..."
|
|
||||||
wget -q "$url" -O "$CIDR_FILE"
|
|
||||||
if [[ $(wc -l < "$CIDR_FILE") -gt 10 ]]; then
|
|
||||||
echo " [+] Success: $(wc -l < "$CIDR_FILE") entries"
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ $(wc -l < "$CIDR_FILE") -lt 10 ]]; then
|
|
||||||
echo "[!] All sources failed. Aborting."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "[*] Creating ipset..."
|
|
||||||
ipset create "$IPSET_NAME" hash:net 2>/dev/null || ipset flush "$IPSET_NAME"
|
|
||||||
|
|
||||||
echo "[*] Populating ipset..."
|
|
||||||
while IFS= read -r cidr; do
|
|
||||||
[[ -z "$cidr" ]] && continue
|
|
||||||
ipset add "$IPSET_NAME" "$cidr"
|
|
||||||
done < "$CIDR_FILE"
|
|
||||||
|
|
||||||
echo "[*] Saving ipset..."
|
|
||||||
ipset save > /etc/ipset.conf
|
|
||||||
|
|
||||||
echo "[*] Adding iptables rules directly..."
|
|
||||||
iptables -A INPUT -m set --match-set "$IPSET_NAME" src -j DROP
|
|
||||||
iptables -A OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP
|
|
||||||
|
|
||||||
echo "[*] Saving iptables rules..."
|
|
||||||
iptables-save > /etc/iptables/iptables.rules
|
|
||||||
systemctl enable --now iptables
|
|
||||||
|
|
||||||
echo "[+] Done! Chinese IPs are now blocked."
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
IPSET_NAME="china"
|
|
||||||
|
|
||||||
echo "[*] Removing iptables rules..."
|
|
||||||
iptables -D INPUT -m set --match-set "$IPSET_NAME" src -j DROP 2>/dev/null || true
|
|
||||||
iptables -D OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP 2>/dev/null || true
|
|
||||||
|
|
||||||
echo "[*] Destroying ipset..."
|
|
||||||
ipset destroy "$IPSET_NAME" 2>/dev/null || true
|
|
||||||
rm -f /etc/ipset.conf /tmp/cn.cidr /etc/iptables/iptables.rules
|
|
||||||
|
|
||||||
echo "[+] Done! Chinese IPs are now unblocked."
|
|
||||||
Reference in New Issue
Block a user