{"id":373,"date":"2013-10-23T14:58:04","date_gmt":"2013-10-23T14:58:04","guid":{"rendered":"http:\/\/blog.shineservers.com\/?p=373"},"modified":"2013-10-23T14:58:04","modified_gmt":"2013-10-23T14:58:04","slug":"iptables-blacklists","status":"publish","type":"post","link":"https:\/\/www.shineservers.com\/2013\/10\/23\/iptables-blacklists\/","title":{"rendered":"IPtables Blacklists"},"content":{"rendered":"

Many of you already use online blacklists to fight spam. Recently I’ve dicovered\u00a0http:\/\/www.openbl.org\/<\/a>\u00a0and started using their lists on my firewall to prevent attacks from hosts that are known to be preforming attacks. It works in a\u00a0very similar way to all the spam blacklists out there, and this is how I’ve implemented them on my Firewall.<\/p>\n

First of all you’ll need to \u00a0have some packages installed:<\/p>\n

sudo apt-get install iptables ipset wget<\/p><\/blockquote>\n

now create an ipset to store all the abusing IP addresses and use iptables to block them:<\/p>\n

#!\/bin\/bash
\nBLOCKDB=”block.txt”
\nWORKDIR=”\/tmp”
\npwd=$(pwd)
\ncd $WORKDIR
\n#List of ips to block
\nipset –create blackips iphash
\n## Obtain List of badguys from openbl.org
\nwget -q -c –output-document=$BLOCKDB http:\/\/www.openbl.org\/lists\/base.txt
\nif [ -f $BLOCKDB ]; then
\nIPList=$(grep -Ev “^#” $BLOCKDB | sort -u)
\nfor i in $IPList
\ndo
\nipset –add blackips $i
\ndone
\nfi
\nrm $BLOCKDB
\n## Obtain List of badguys from ciarmy.com
\nwget -q -c –output-document=$BLOCKDB http:\/\/www.ciarmy.com\/list\/ci-badguys.txt
\nif [ -f $BLOCKDB ]; then
\nIPList=$(grep -Ev “^#” $BLOCKDB | sort -u)
\nfor i in $IPList
\ndo
\nipset –add blackips $i
\ndone
\nfi
\nrm $BLOCKDB
\n## Obtain List of badguys from dshield.org
\nwget -q -c –output-document=$BLOCKDB http:\/\/feeds.dshield.org\/top10-2.txt
\nif [ -f $BLOCKDB ]; then
\nIPList=$(grep -E “^[1-9]” $BLOCKDB | cut -f1 | sort -u)
\nfor i in $IPList
\ndo
\nipset –add blackips $i
\ndone
\nfi
\nrm $BLOCKDB
\n#List of networks to block
\nipset –create blacknets nethash
\n## Obtain List of badguys from dshield.org
\nwget -q -c –output-document=$BLOCKDB http:\/\/feeds.dshield.org\/block.txt
\nif [ -f $BLOCKDB ]; then
\nIPList=$(grep -E “^[1-9]” $BLOCKDB | cut -f1,3 | sed “s\/\\t\/\\\/\/g” | sort -u)
\nfor i in $IPList
\ndo
\nipset –add blacknets $i
\ndone
\nfi
\nrm $BLOCKDB
\n## Obtain List of badguys from spamhaus.org
\nwget -q -c –output-document=$BLOCKDB http:\/\/www.spamhaus.org\/drop\/drop.lasso
\nif [ -f $BLOCKDB ]; then
\nIPList=$(grep -E “^[1-9]” $BLOCKDB | cut -d” ” -f1 | sort -u)
\nfor i in $IPList
\ndo
\nipset –add blacknets $i
\ndone
\nfi
\nrm $BLOCKDB
\n#Drop blacklisted ips
\niptables -A FORWARD -m set –match-set blackips src -j DROP
\niptables -A FORWARD -m set –match-set blacknets src -j DROP
\ncd $pwd<\/p><\/blockquote>\n

In the above script I’ve used two ipsets, one for storing IP addresses and another to store network addresses, you can add this scritp to your existing firewall and start taking advantage of the blacklists.<\/div>\n","protected":false},"excerpt":{"rendered":"

Many of you already use online blacklists to fight spam. Recently I’ve dicovered\u00a0http:\/\/www.openbl.org\/\u00a0and started using their lists on my firewall to prevent attacks from hosts that are known to be preforming attacks. It works in a\u00a0very similar way to all the spam blacklists out there, and this is how I’ve implemented them on my Firewall. […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[60],"tags":[143],"class_list":["post-373","post","type-post","status-publish","format-standard","hentry","category-linux","tag-iptables-blacklists"],"acf":[],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/posts\/373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/comments?post=373"}],"version-history":[{"count":0,"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/posts\/373\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/media?parent=373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/categories?post=373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.shineservers.com\/wp-json\/wp\/v2\/tags?post=373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}