1
I currently use -j DROP in my Linux based router commands to keep international spammers out of my Windows Server 2016 based server, and would like to block entire countries where the spammers originate (I'm aware of the response time impact this will have). Since my server is regionally specific anyway, nobody outside of the US needs access. This is a sample of what's in my Commands page on my router:
iptables -I FORWARD -s 218.0.0.0/8 -j DROP
iptables -I FORWARD -s 112.0.0.0/8 -j DROP
iptables -I FORWARD -s 59.0.0.0/8 -j DROP
iptables -I FORWARD -s 58.22.0.0/15 -j DROP
iptables -I FORWARD -s 208.88.96.0/21 -j DROP
iptables -I FORWARD -s 117.0.0.0/8 -j DROP
iptables -I FORWARD -s 125.0.0.0/8 -j DROP
iptables -I FORWARD -s 192.245.43.0/24 -j DROP
iptables -I FORWARD -s 121.0.0.0/8 -j DROP
iptables -I FORWARD -s 124.0.0.0/8 -j DROP
iptables -I FORWARD -s 123.0.0.0/8 -j DROP
iptables -I FORWARD -s 122.0.0.0/8 -j DROP
iptables -I FORWARD -s 116.0.0.0/8 -j DROP
iptables -I FORWARD -s 113.0.0.0/8 -j DROP
China alone has over 8000 IP scopes that I'd like to add, but I don't want to have to manually create each line with the applicable IP scopes.
Is there any type of script or website where I can simply paste a list of all 8000+ IP CIDR scopes that will create my commands for me to copy and paste back into my router? I have to believe there is a way to automate this redundant coding.
MontanaBighorn
Posted 2020-01-11T00:22:36.610
Reputation: 19
I wonder if that would give a larger performance impact than the "spam"/"attack"... – Tom Yan – 2020-01-11T07:30:52.970
I would not recommend using iptables, as that would have a large impact on performance and be very hard to maintain (since these “national” CIDR scopes change on a regular basis). Instead, you could use a GeoIP database, like the one from MaxMind which unfortunately now requires (free) registration. If you have a Linux distribution that supports TCP wrappers, you could write a script that checks the originating country by IP its source address when initiating a connection and either allow or reject it. See for example here: https://www.linuxsecrets.com/3805-tcp-wrapper-block
– StarCat – 2020-01-11T07:41:09.110