Iptables block ip address – Security Shell Script

by NIXCRAFT on DECEMBER 20, 2008 ·

Create /root/iptables/blocked.ips file as follows with list of ips and subnets to block entering your dedicated server:

192.168.1.0/24
202.54.1.2
# spam
202.5.1.2

Call following script from your existing shell script:

#!/bin/bash


# Simple iptables IP/subnet block script 


# -------------------------------------------------------------------------


# Copyright (c) 2004 nixCraft project <http://www.cyberciti.biz/fb/>


# This script is licensed under GNU GPL version 2.0 or above


# -------------------------------------------------------------------------


# This script is part of nixCraft shell script collection (NSSC)


# Visit http://bash.cyberciti.biz/ for more information.


# ----------------------------------------------------------------------


IPT=/sbin/iptables


SPAMLIST="spamlist"


SPAMDROPMSG="SPAM LIST DROP"


BADIPS=$(egrep -v -E "^#|^$" /root/iptables/blocked.ips)





# create a new iptables list


$IPT -N $SPAMLIST





for ipblock in $BADIPS


do


$IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"


$IPT -A $SPAMLIST -s $ipblock -j DROP


done





$IPT -I INPUT -j $SPAMLIST


$IPT -I OUTPUT -j $SPAMLIST


$IPT -I FORWARD -j $SPAMLIST