Iptables deny ip

1systemctl stop firewalld.service
2systemctl disable firewalld.service
3
4yum install ipset
5yum install iptables-services

1iptables -P INPUT ACCEPT
2iptables -F

1ipset -N cnip hash:net
2ipset save
3# 下载国家IP段，这里以中国为例
4wget -P . http://www.ipdeny.com/ipblocks/data/countries/cn.zone
5# 将IP段添加到cnip规则中
6for i in $(cat /root/cn.zone ); do ipset -A cnip $i; done
7
8ipset save cnip -f /etc/ipset.cnip
9/sbin/ipset restore -f /etc/ipset.cnip

1iptables -A INPUT -p tcp -m set --match-set cnip src -j ACCEPT

 1iptables -P INPUT DROP
 2# 关闭指定端口，比如80/443
 3iptables -A INPUT -p tcp --dport 80 -j DROP
 4iptables -A INPUT -p tcp --dport 443 -j DROP
 5
 6# 将参数里的-A改成-D就是删除规则了，如
 7iptables -D INPUT -p tcp -m set --match-set cnip src -j ACCEPT
 8iptables -D INPUT -p tcp --dport 443 -j DROP
 9
10# save
11iptables-save > /etc/sysconfig/iptalbes
12iptables-save > /etc/iptables-script
13# restore
14iptables-restore > /etc/sysconfig/iptables
15iptables-restore > /etc/iptables-script

1#全部接受中国IP
2-A INPUT -m set --match-set china src -j ACCEPT
3#接受中国IP访问本机特定端口特定协议（例如5060UDP协议），freeswitch一般要用这条，直接具体到端口协议
4-A INPUT -m set --match-set china src -p udp -m udp --dport 5060 -j ACCEPT
5#接受中国IP的ping响应
6-A INPUT -m set --match-set china src -p icmp -j ACCEPT

1#!/bin/bash
2ipset create china hash:net hashsize 1024 maxelem 65536
3rm -f cn.zone
4wget http://www.ipdeny.com/ipblocks/data/countries/cn.zone
5for i in `cat cn.zone`
6do
7ipset add china $i
8done

1#!/bin/bash
2ipset create hongkong hash:net hashsize 1024 maxelem 65536
3rm -f hk.zone
4wget http://www.ipdeny.com/ipblocks/data/countries/hk.zone
5for i in `cat hk.zone`
6do
7ipset add hongkong $i
8done

1vim /etc/sysconfig/iptables

 1*filter
 2:INPUT ACCEPT [0:0]
 3:FORWARD ACCEPT [0:0]
 4:OUTPUT ACCEPT [0:0]
 5-A INPUT -m set --match-set cnip src -j ACCEPT
 6-I INPUT -m set --match-set hongkong src -j DROP
 7-I INPUT -p tcp --dport 80 --syn -m recent --name SYN_FLOOD --update --seconds 60 --hitcount 10 -j REJECT
 8-I INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT
 9-A INPUT -j DROP
10COMMIT
11# Completed on Sun Mar 27 20:29:24 2022

1ipset save > /etc/ipset.cn.hk
2/sbin/ipset restore -f /etc/ipset.cn.hk
3systemctl restart iptables

1iptables -L -n --line-number
2iptables -vnL
3netstat -an | awk '/^tcp/ {++s[$NF]} END {for(a in s ) print a,s[a]}'

1iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT

1iptables -I INPUT -p tcp --dport 80 --syn -m recent --name SYN_FLOOD --update --seconds 60 --hitcount 10 -j REJECT