Blocking IP ranges using IBLOCK lists and iptables
#I’ve started looking at the iptables function within the Linux kernel, and found out, that with a bit of tinkering, you can use the IBLOCK lists to do a machine-wide block based on IP. You use pipes (gotta love ‘em) to route them into ipset which allows you to create a set of IP addresses/ranges which then reference in the iptables. You can use wget or curl. If you use wget, you might need to use the quiet switch. You can use xargs to multi-download lists and concatenate. I’m tinkering with my download script at the moment.
First, create the set. Here, I have used a high maxelem number because I use a lot of IBLOCK’s lists. The “maxelem 1048576” can be omitted or the number reduced if you are only using one or a small number of IBLOCK lists.
ipset create IBLOCK hash:net maxelem 1048576
Second, download and add to the set if it doesn’t already exist. You can chain multiple lists into the wget or use xargs. For this example, I’m only using one.
wget -q "[list.iblocklist.com](http://list.iblocklist.com/?list=bt_level1&fileformat=p2p&archiveformat=gz)" -O- |
gunzip |
cut -d: -f2 |
grep -E "^[-0-9.]+$" |
gawk '{print "add IBLOCK "$1}' |
ipset restore -exist
Finally, add rules into the iptables to drop package to and from IP addresses that exist in the set. This means that packets coming in from external IPs that match IP addresses in the set will not be answered.
iptables -I INPUT -m set --match-set IBLOCK src -j DROP iptables -I OUTPUT -m set --match-set IBLOCK dst -j DROP
When I tried this with my IBLOCK download script, it seemed to kill TOR functionality as well, which I suspect means that IBLOCK have included the TOR IP range in one or more of their lists, so I’ll need to determine which one(s) they are and exclude them, as I do use TOR actively.
As with most things, there’s more than one way to do this, and this is one of many ways you could implement blocking behaviour.