[Unit]
Description=Block Chinese IP ranges via ipset + iptables
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/sbin/china-block.sh
ExecStop=/usr/local/sbin/china-unblock.sh

[Install]
WantedBy=multi-user.target