my goal is to drop with iptables more or less every request from non-german countries.
the best solution that is working in 2022 is this five year old script.
(Source: https://www.cyberciti.biz/faq/block-entier-country-using-iptables/)
with the help of this script-template and some iptables tutorials I'm able to allow (more or less accurate) only German IP-Ranges.
This is my modified script: (it's not optimized yet, but should block every non-german IP-Requests)
ISO="de"
IPT=/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep
SPAMLIST="countrydrop"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT
$IPT -F
$IPT -N $SPAMLIST
for c in $ISO
do
tDB=$ZONEROOT/$c.zone
$WGET -O $tDB $DLROOT/$c.zone
BADIPS=$(egrep -v "^#|^$" $tDB)
for ipblock in $BADIPS
do
$IPT -A $SPAMLIST ! -s $ipblock -j DROP
done
done
exit 0
but if I let the script run, it creates the rule and then I want to make the default rule "incoming traffic" to drop, he locks me instantly out.
I know, IP tables is processing the rules from top to button, but now I'm not sure how to handle it in the script.
Or do I don't need to make the default incoming chain/rule to block everything, because I already blocked everything except German IP Adresses? Or should I put the default drop on top of the script? this is how I'd edit the default incoming rule:
iptables --policy INPUT DROP
... but it feels kinda bad, if I let the default incoming rule untouched .. what do you think?
in the end I'd like to:
- block everything by default
- except German IP Adresses
- and open about ~5 ports (only for German IP-Adresses)
If I could handle this in only one script, that's always running on boot, I'd be really happy! :-)
P.S: I'm sure, I'm not the only one who is looking for a up2date solution for this task, it would be awesome if some people could help to find a solution for this case :-)
