Bdtyktl

I just logged in on a GitLab server and noticed that it had 18.974 failed logins since I last checked the server - almost 5 days. I checked the Ip's and it seems that almost all of them were from China and tried to gain access with SSH and Brute Force. I started to block some Ip's but then i realized that it is a huge waste of time and a better idea would be to block the entire country.

Is there any way i can block ALL China or any other country with iptables?

I found some articles on the internet but almost all of them are bash scripts. I'm a newbie on Linux so i don't really understand all those scripts. I find iptables really interesting and i want to learn more about it.

Any ideas ?
Thank you!

Using iptables to automatically identify, and thereafter block, bad guys for ssh can be done using the recent module. The following segment must come after your generic ESTABLISHED,RELATED line:

...

$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT

...

# Secure Shell on port 22.

#

# Sometimes I uncomment the next line to simply disable external SSH access.

# Particulalry useful when I am rebooting often, thereby losing my current BADGUY table.

# $IPTABLES -A INPUT -i $EXTIF -m state --state NEW -p tcp -s $UNIVERSE -d $EXTIP --dport 22 -j DROP



# Dynamic Badguy List. Detect and DROP Bad IPs that do password attacks on SSH.

# Once they are on the BADGUY list then DROP all packets from them.

# Sometimes make the lock time very long. Typically to try to get rid of coordinated attacks from China.

$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 3 --seconds 90000 --name BADGUY_SSH -j LOG --log-prefix "SSH BAD:" --log-level info

$IPTABLES -A INPUT -i $EXTIF -m recent --update --hitcount 3 --seconds 90000 --name BADGUY_SSH -j DROP

$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 -m recent --set --name BADGUY_SSH -j ACCEPT

Now, the recent (the last year or two) problem with China is that they have become very clever and very often once they get blocked from one IP address they simply switch to another on the same sub-net and continue. This runs the risk of running out of default recent table entries (I think the default is 200). I monitor this and then look up the actual IP segment, and permanently block the entire segment. In my case, I do not care about collateral damage, i.e. blocking someone innocent:

#

# After a coordinated attack involving several sub-nets from China, they are now banned forever.

# List includes sub-nets from unknown origin, and perhaps Hong Kong

#

$IPTABLES -A INPUT -i $EXTIF -s 1.80.0.0/12 -d $UNIVERSE -j DROP

$IPTABLES -A INPUT -i $EXTIF -s 27.148.0.0/14 -d $UNIVERSE -j DROP

$IPTABLES -A INPUT -i $EXTIF -s 27.152.0.0/13 -d $UNIVERSE -j DROP

$IPTABLES -A INPUT -i $EXTIF -s 43.229.0.0/16 -d $UNIVERSE -j DROP

$IPTABLES -A INPUT -i $EXTIF -s 43.255.0.0/16 -d $UNIVERSE -j DROP

...

Where in the above:

# The location of the iptables program

#

IPTABLES=/sbin/iptables



#Setting the EXTERNAL and INTERNAL interfaces and addresses for the network

#

EXTIF="enp4s0"

INTIF="enp2s0"

EXTIP="...deleted..."

INTNET="192.168.111.0/24"

INTIP="192.168.111.1/32"

UNIVERSE="0.0.0.0/0"

You can get the entire list of IP addresses for China, or any country, in iptables, or other, format here. However the list is both surprisingly long and rather dynamic. Myself, I decided not to block the entire list.

China block using ipset

You can't manually add a few thousand IP addresses to your iptables, and even doing it automatically is a bad idea because it can cause a lot of CPU load (or so I've read). Instead we can use ipset which is designed for this sort of thing. ipset handles big lists of ip addresses; you just create a list and then tell iptables to use that list in a rule.

Note; I assume that the entirety of the following is done as root. Adjust accordingly if your system is based on sudo.

apt-get install ipset

Next, I wrote a small Bash script to do all the work, which you should be able to understand from the comments in it. Create a file:

nano /etc/block-china.sh

Here's what you want to paste into it:

# Create the ipset list

ipset -N china hash:net



# remove any old list that might exist from previous runs of this script

rm cn.zone



# Pull the latest IP set for China

wget -P . http://www.ipdeny.com/ipblocks/data/countries/cn.zone



# Add each IP address from the downloaded list into the ipset 'china'

for i in $(cat /etc/cn.zone ); do ipset -A china $i; done



# Restore iptables

/sbin/iptables-restore < /etc/iptables.firewall.rules

Save the file. Make it executable:

chmod +x /etc/block-china.sh

This hasn't done anything yet, but it will in a minute when we run the script. First, we need to add a rule into iptables that refers to this new ipset list the script above defines:

nano /etc/iptables.firewall.rules

Add the following line:

-A INPUT -p tcp -m set --match-set china src -j DROP

Save the file. To be clear, my full iptables.firewall.rules now looks like this:

*filter



#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0

-A INPUT -i lo -j ACCEPT

-A INPUT -d 127.0.0.0/8 -j REJECT



#  Accept all established inbound connections

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT



# Block anything from China

# These rules are pulled from ipset's china list

# The source file is at /etc/cn.zone (which in turn is generated by a shell script at /etc/block-china.sh )

-A INPUT -p tcp -m set --match-set china src -j DROP



#  Allow all outbound traffic - you can modify this to only allow certain traffic

-A OUTPUT -j ACCEPT



#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).

-A INPUT -p tcp --dport 80 -j ACCEPT

-A INPUT -p tcp --dport 443 -j ACCEPT



#  Allow SSH connections

#

#  The -dport number should be the same port number you set in sshd_config

#

-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT



#  Allow ping

-A INPUT -p icmp -j ACCEPT



#  Log iptables denied calls

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7



#  Drop all other inbound - default deny unless explicitly allowed policy

-A INPUT -j DROP

-A FORWARD -j DROP



COMMIT

Right now, nothing has changed with the server because no new rules have been applied; to do so, run the block-china.sh script:

/etc/block-china.sh

This should show some output as it pulls a fresh list of Chinese based IPs and then, after a few seconds or so, it will complete and drop you back to a command prompt.

To test if it worked, run:

iptables -L

You should now see a new rule blocking China – the output ought to look like this:

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere

REJECT     all  --  anywhere             loopback/8           reject-with icmp-port-unreachable

ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

DROP       tcp  --  anywhere             anywhere             match-set china src

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http

ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https

ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh

ACCEPT     icmp --  anywhere             anywhere

LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "

DROP       all  --  anywhere             anywhere



Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

DROP       all  --  anywhere             anywhere



Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere

Almost done! This works, and will continue to work on re-boots. But, IP addresses change and that list will grow stale over time. If you want to pull and apply an updated list of IPs you can just run the block-china.sh script again.

We can also set the machine to do that automatically via a cron job:

crontab -e

Add a line such as this:

* 5 * * * /etc/block-china.sh

This will run /etc/block-china.sh at 5am every day. The user running the script will need to be root or have root privileges.

source

You may want to install something like fail2ban so that it blocks ips that attempt to log into your server and fail.

You can use the geoip-module for iptables:
https://linoxide.com/linux-how-to/block-ips-countries-geoip-addons/

Once our system is upgraded and dependencies are installed, we'll now
install the xtables-addons in our machine. To do so, we'll download
the latest tarball from the official xtables-addons project site using
wget. Once it's downloaded, we'll extract the tarball, then compile
and install it in our machine.

wget http://downloads.sourceforge.net/project/xtables-addons/Xtables-addons/xtables-addons-2.13.tar.xz

tar xf xtables-addons-2.13.tar.xz

cd xtables-addons-2.13

./configure

make

make install [...]

Next, we'll run a module called xt_geoip that comes with the
xtables-addons extension which downloads the GeoIP database from
MaxMind and converts it into a binary form recognized by xt_geoip.
Once it's downloaded, we'll build it and move them to the required
xt_geoip path ie /usr/share/xt_geoip.

cd geoip

./xt_geoip_dl

./xt_geoip_build GeoIPCountryWhois.csv

mkdir -p /usr/share/xt_geoip/

cp -r {BE,LE} /usr/share/xt_geoip/

Here's the basic syntax for using iptables with geoip module in order
to block traffic originating from or destined to a country. Here, we
need to use two-letter ISO3166 code in place of country , for eg., US
for United States, IE for Ireland, IN for India, CN for China and so
on.

iptables -m geoip --src-cc country[,country...] --dst-cc country[,country...]