IPTABLES GeoIP Addon

Posted 2021-03-06 ticonci

准备xtables-addons-3.0--------------------2018年02月版本
https://newcontinuum.dl.sourceforge.net/project/xtables-addons/Xtables-addons/xtables-addons-3.0.tar.xz

环境检查是否满足需求，具体查看以下链接
https://sourceforge.net/p/xtables-addons/xtables-addons/ci/master/tree/INSTALL

Use xtables-addons-1.x if you need support for Linux < 3.7.
Use xtables-addons-2.x if you need support for Linux < 4.15.

如果要升级内核，参考以下
https://www.vultr.com/docs/how-to-deploy-google-bbr-on-centos-7

内核升级完成后，安装内核开发包(centos, fedora内核不用升级)
安装组件

yum install gcc-c++ make automake wget unzip iptables-devel perl-Text-CSV_XS -y

卸载旧版冲突组件

yum remove kernel-{devel,tools,tools-libs} -y

安装新版

yum --enablerepo=elrepo-kernel install kernel-ml-{devel,tools,tools-libs} -y

创建编译目录

mkdir -p /home/xtables
cd /home/xtables
tar xf xtables-addons-3.0.tar.xz
cd cd xtables-addons-3.0
./configure
make
make install

安装GeoIP Database

cd geoip
./xt_geoip_dl
./xt_geoip_build GeoIPCountryWhois.csv
mkdir -p /usr/share/xt_geoip/
cp -r {BE,LE} /usr/share/xt_geoip/

使用iptables

iptables -m geoip --src-cc country[,country...] --dst-cc country[,country...]

Example:
block incoming traffic from India (IN) and United States (US)
iptables -I INPUT -m geoip --src-cc IN,US -j DROP
block all incoming non-US traffic on our server
iptables -I INPUT -m geoip ! --src-cc US -j DROP
block outgoing traffic destined to India (IN)
iptables -A OUTPUT -m geoip --dst-cc IN -j DROP

使用firewalld

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -m geoip --src-cc IN,UN -j DROP
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -m geoip ! --src-cc US -j DROP
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc IN -j DROP

Enjoy :-)

special for vps using firewalld

firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 80 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 443 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -j DROP
firewall-cmd --direct --permanent --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 80 -j ACCEPT
firewall-cmd --direct --permanent --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 443 -j ACCEPT
firewall-cmd --direct --permanent --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -j DROP