Recently I have had quite a few bouts with people trying all sorts of nefarious things with my VPS from various places in the world. I realized the best way is to take whole countries out of the equation and I wanted to make this a nice easy way of doing this.
First of all, I soon realized that I needed to be a little bit restrictive but since some of the domains that runs on the server is probably legitimately accessed I wanted to divide all countries up in three categories:
0 – No restrictions
1 – Restricted access, basically just allowing ICMP and http on port 80
2 – Complete blocking, drop all packets
So countries in the 0 class would be Sweden and all countries where there is a reasonable legal system and where I have not yet seen too many attempts on the security from. Class 1 would be places like Russia, where there are legit traffic but also a lot of crap coming from and Class 2 would be china where there is likely no legit traffic and still a lot of attempts on the security.
First of all, you need to get hold of a zone file divided on country by country. This is also called a CIDR file (Classless Internet Domain Routing) where all the IP blocks assigned on an international level are put in the right file. You can find this here. Just download the file with all the blocks in and keep it somewhere. You may want to refresh this now and then, say on a montly basis or so.
I am assuming you already have an iptables script file and that you are just looking at adding this functionality. Open the script file and add the following to it
# Loop over all lists of banned networks
# Any rules below this will not work on these ranges as they will
# drop before they reach any other rule. If you want to open some ports
# even for banned countries, then you need to put those rules in front
# of this rule!
echo "Kill line certain CIDR, one way of blocking suspect countries!"
for f in /etc/iptables/banned-hosts/*
do
echo "Processing k-line file $f..."
while read p
do
$IPTABLES -A INPUT -s $p -j CBLK
done < $f
done
This script should be placed before any rules that will allow any traffic what so ever!
After this part you place the rules that allows any traffic you wish to allow from the restricted countries and then you place this after those rules:
# Restricted hosts here from CIDR files in the restricted session
# these guys will only be able to do ICMP and http, nothing else
# and that should be quite a few countries
echo "Restrict line certain CIDR, one way of blocking suspect countries!"
for f in /etc/iptables/restricted-hosts/*
do
echo "Processing r-line file $f..."
while read p
do
$IPTABLES -A INPUT -s $p -j CBLK
done < $f
done
Now you should create the following directories:
sudo mkdir /etc/iptables sudo mkdir /etc/iptables/banned-hosts/ sudo mkdir /etc/iptables/restricted-hosts/
Explode the file you downloaded with all the IP Blocks in country by country into the /etc/iptables/banned-hosts/ directory and you should get a bunch of files called af.zone, al.zone and so on. Each of these referrs to a ISO 2 letter country code.
Do not run the iptables script at this point. Start by removing the file for your own country. In my case that would be se.zone for Sweden. Your mileage may vary here. Refer to this page if you do not know the country codes (which are the same as these countries internet domains).
Delete the files that you do not wish to impose any restrictions on.
Move the files for the countries you want to restrict to the /etc/iptables/restricted-hosts/ dir.
Anything remaining when you are done in the /etc/iptables/banned-hosts/ will be denied access when you run your iptables script.
So run the script now, it may take some time.
When you are done run the command iptables-save > /etc/iptables/tables to save your iptables then add the line in /etc/rc.local or some other similar place iptables-restore < /etc/iptables/tables in order to automatically load your tables on boot time.
Full example
echo "### IP-tables ###"
IPTABLES=/sbin/iptables
echo "Default policies."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
echo "Flushing old rules"
$IPTABLES -F
$IPTABLES -X
echo "Create LOGDROP chain"
$IPTABLES -N LOGDROP
$IPTABLES -A LOGDROP -j LOG --log-prefix "IPT: DROP " --log-level 7
$IPTABLES -A LOGDROP -j DROP
echo "Create LOGACCEPT chain"
$IPTABLES -N LOGACCEPT
$IPTABLES -A LOGACCEPT -j LOG --log-prefix "IPT: ACCEPT " --log-level 7
$IPTABLES -A LOGACCEPT -j ACCEPT
echo "Create INVALIDDROP chain"
$IPTABLES -N INVALIDDROP
$IPTABLES -A INVALIDDROP -j LOG --log-prefix "IPT: INVALID " --log-level 7
$IPTABLES -A INVALIDDROP -j DROP
echo "Killfile certain IP chain"
$IPTABLES -N BANNED
$IPTABLES -A BANNED -j LOG --log-prefix "IPT: BANNED " --log-level 7
$IPTABLES -A BANNED -j DROP
echo "Create a country block chain"
$IPTABLES -N CBLK
$IPTABLES -A CBLK -j LOG --log-prefix "IPT: CBLK " --log-level 7
$IPTABLES -A CBLK -j DROP
# Loop over all lists of banned networks
# Any rules below this will not work on these ranges as they will
# drop before they reach any other rule. If you want to open some ports
# even for banned countries, then you need to put those rules in front
# of this rule!
echo "Kill line certain CIDR, one way of blocking suspect countries!"
for f in /etc/iptables/banned-hosts/*
do
echo "Processing k-line file $f..."
while read p
do
$IPTABLES -A INPUT -s $p -j CBLK
done < $f
done
echo "Enabling ICMP"
$IPTABLES -A INPUT -p icmp -j LOGACCEPT
$IPTABLES -A OUTPUT -p icmp -j LOGACCEPT
echo "Enabling http on standard port"
$IPTABLES -A INPUT -p tcp --dport http -m state --state NEW -j LOGACCEPT
$IPTABLES -A INPUT -p tcp --dport http -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --sport http -m state --state ESTABLISHED -j ACCEPT
# Restricted hosts here from CIDR files in the restricted session
# these guys will only be able to do ICMP and http, nothing else
# and that should be quite a few countries
echo "Restrict line certain CIDR, one way of blocking suspect countries!"
for f in /etc/iptables/restricted-hosts/*
do
echo "Processing r-line file $f..."
while read p
do
$IPTABLES -A INPUT -s $p -j CBLK
done < $f
done
echo "Dropping invalid packets"
$IPTABLES -A INPUT -m state --state INVALID -j INVALIDDROP
echo "Enabling DNS server connections."
$IPTABLES -A INPUT -p tcp --sport domain -j ACCEPT
$IPTABLES -A INPUT -p udp --sport domain -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport domain -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport domain -j ACCEPT
echo "Enabling NTP server connections."
$IPTABLES -A INPUT -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 123 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 123 -m state --state NEW -j LOGACCEPT
echo "Applying rules for inbound and outbound ssh"
$IPTABLES -A INPUT -p tcp --dport gopher -m state --state NEW -j LOGACCEPT
$IPTABLES -A INPUT -p tcp --dport gopher -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --sport gopher -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport gopher -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport gopher -m state --state NEW -j LOGACCEPT
$IPTABLES -A OUTPUT -p tcp --dport gopher -m state --state ESTABLISHED -j ACCEPT
echo "Applying rules for outbound ssh standard port"
$IPTABLES -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 22 -m state --state NEW -j LOGACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT
echo "Enabling https traffic out from this machine"
$IPTABLES -A INPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport 443 -m state --state NEW -j LOGACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 443 -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 443 -m state --state NEW -j LOGACCEPT
echo "Dropping all other input packets."
$IPTABLES -A INPUT -j LOGDROP
echo "Done."
echo "IPV6 setting policy"
/sbin/ip6tables -P INPUT DROP
/sbin/ip6tables -P OUTPUT DROP
/sbin/ip6tables -P FORWARD DROP
echo "IPV6 flushing tables"
/sbin/ip6tables -F
echo "IPV6 Done."