Blocking all ip traffic from a single country using iptables.

Sometimes you may find that you are getting a lot of unwelcome traffic from a particular country. This may be a compromised server trying to find exploits, or sometimes it a badly tuned search engine that is hammering your webserver. In this post, I’ll provide a script that will help you block out traffic from a particular country, or set of countries.

First, you need to get list of netblocks for each country. Simply visit http://www.ipdeny.com/ipblocks/ and download IP block files are provided in CIDR format.

Next, use the following shell script to add the countries to your iptables block list. Just add the ISO code in the ISO variable.

    #!/bin/bash
    ### Block all traffic from AFGHANISTAN (af) and CHINA (CN). Use ISO code ###
    ISO="cn"

    ### Set PATH ###
    IPT=/sbin/iptables
    WGET=/usr/bin/wget
    EGREP=/bin/egrep

    ### No editing below ###
    SPAMLIST="countrydrop"
    ZONEROOT="/root/iptables"
    DLROOT="http://www.ipdeny.com/ipblocks/data/countries"

    cleanOldRules(){
    $IPT -F
    $IPT -X
    $IPT -t nat -F
    $IPT -t nat -X
    $IPT -t mangle -F
    $IPT -t mangle -X
    $IPT -P INPUT ACCEPT
    $IPT -P OUTPUT ACCEPT
    $IPT -P FORWARD ACCEPT
    }

    # create a dir
    [ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT

    # clean old rules
    cleanOldRules

    # create a new iptables list
    $IPT -N $SPAMLIST

    for c in $ISO
    do
    # local zone file
    tDB=$ZONEROOT/$c.zone

    # get fresh zone file
    $WGET -O $tDB $DLROOT/$c.zone

    # country specific log message
    SPAMDROPMSG="$c Country Drop"

    # get
    BADIPS=$(egrep -v "^#|^$" $tDB)
    for ipblock in $BADIPS
    do
    #$IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"
    #Use the above if you need logging.
    $IPT -A $SPAMLIST -s $ipblock -j DROP
    done
    done

    # Drop everything
    $IPT -I INPUT -j $SPAMLIST
    $IPT -I OUTPUT -j $SPAMLIST
    $IPT -I FORWARD -j $SPAMLIST

    # call your other iptable script
    # /path/to/other/iptables.sh
   $IPT -A countrydrop -p tcp -m tcp --dport 80 -j ACCEPT 
   $IPT -A countrydrop -p tcp -m tcp --dport 443 -j ACCEPT 


    exit 0