Blocking IPs by country using IPSet and IPTables

Introduction

What would you do when you want to allow access only to specific countries to access content on your server? Actually there are many ways to do it, like by installing application, using mod_geoip with Apache, etc.
But all that isn't global, i.e. if you use Apache to block ips, other ports will be still open to the blocked countries. It might be global in an exceptional case if you installed an application that sits listening to all connections something like a firewall.
But what's the guarantee that it will not be a bloat or extra load on the system? There's no guarantee about it.
So here we have something nice, different, trustable, easy to use and lightweight, IPSets in combination with IPTables.

What is IPSet?

IPSet basically allows you to store multiple IP addresses and/or ports in a table and match across all of them at once. The table seeks are much faster than using individual IPTables rules.
IPSet framework is included in 2.4.x and 2.6.x kernels by default, but the utility with which it has to be managed has to be installed separately. I have a no clear idea if an distributions have packages for IPSet.

Some features of IPSets

1. Store multiple IP addresses or ports in a table and match against it using iptables at once without much performance overhead.
2. Dynamically update the IP addresses or ports in the table, without changing the rules in iptables, again low performance penalty.
3. Express multiple IP addresses and ports in one single iptables rule, that is, with one single rule, you can match against a million IPs (just an example, there can be even more).

Installing IPSet

You will need the source code for the current kernel you are running. It is usually available as a kernel-headers package. Varies from distribution to distribution. In most cases the kernel source code is found under /usr/src/linux-<version> which is easier to access as /usr/src/linux-$(uname -r) at the shell, because you don't have to type the version. At the time of writing this, there are two versions available for ipset at http://ipset.netfilter.org/install.html.
We will be using ipset 4.5 which is for kernels >= 2.6.16 and >= 2.4.36.
First extract the ipset-4.5.tar.gz and change directory to ipset-4.5:

> tar -xf ipset-4.5.tar.gz
> cd ipset-4.5

Assuming you have the kernel source code available at /usr/src/linux-$(uname -r), issue the following command to compile ipset:

> make KERNEL_DIR=/usr/src/$(uname -r) IP_NF_SET_MAX=256 IP_NF_SET_HASHSIZE=1024

IP_NF_SET_MAX controls the maximum number of IPsets permissible and IP_NF_SET_HASHSIZE sets the default size for hash maps. The default values are used in the above command for illustration, the same values are taken by make even if you don't specify them.
Now to install just run sudo make install or su -c 'make install' if you are running as a user or simply make install if you are running as root:

> sudo make install / su -c 'make install' / make install

If you don't get any errors, installation is complete

Using IPSet to block IPs by country

As the title says, our objective is to block IPs belonging to certain countries. In this article I'll consider China (cn) and Russia (ru) to be blocked.

Creating IPsets and Adding IPs to Them

 

Now that ipset has been installed, let us create the set named `countries'. Please note that all the following commands are to be executed as root, you may use sudo or su -c as applicable.

# ipset -N countries nethash

This creates a new ipset named `country' of type `nethash'. There are different types of ipsets viz. ipmap, macipmap, portmap, iphash, nethash, ipporthash, ipportiphash, ipportnethash, iptree, iptreemap, setlist.
Each set has its own purpose and the use of each set can be found in ipset( man page, also available at http://ipset.netfilter.org/ipset.man.html.
Here we are using `nethash' set type because the IP database at ipdeny.com which we will be using to block IPs provides IPs in IP-Address/CIDR-length form which is supported only by `nethash'.
Now that we have created the set named `countries', we can start adding IP Address to the set. As I said earlier, in this article, blocking China and Russia are taken as an example. No offense meant please.
The IPs existing in China and Russia are found at http://www.ipdeny.com/ipblocks/data/countries/cn.zone and http://www.ipdeny.com/ipblocks/data/countries/ru.zone respectively. To add all the IPs from these two zones, we'll be using a simple bash-for loop coupled along with wget to retrieve to the zone files.

# for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/{cn,ru}.zone)
> do
> ipset -A countries $IP 

> done

This will add all the IPs in the CN and RU zones to the IPset. If you are adding more zones to your block list, please note that the nethash set can store up to 65535 addresses. If you exceed the limit, you must add the remaining in another set, and so on. The total number of IPs in China and Russia zones combined

Matching against the IPSet(s) in IPTables

The IPs which we want to block, have been added to the sets. So now let us add rules in IPTables and block those IPs!
We will be applying the filter on INPUT chain, to block all connections from CN and RU.
So here's how you do it-

# iptables -A INPUT -m set --match-set countries src -j DROP

Now connections from all IPs that exist in the set `countries' that is CN & RU as we created the set above will be blocked, unless you have any other rule before this rule to permit connections.
In case you exceeded the 65535 address limit and you have multiple sets to match with, for example you named the first set `countries', the second one `countries1' and so on, you can add multiple -m set --match-set options to iptables as illustrated below:

# iptables -A INPUT -m set --match-set countries -m set --match-set countries1 -m set --match-set countries2 -j DROP

So, enjoy, secure your server better Questions/Feedback if any can be posted as comments or mailed to me using the contact form.

http://www.itech7.com/Firewall/Blocking-IPs-by-country-using-IPSet-and-IPTables.html

Using IPset with IPtables to block large IP ranges

There are a large number of firewall and security appliances on the market, some good some awful. I tend to use a lot of Cisco security products. With the current supply chain problems in getting hold of Cisco products I have been looking around the market. I have noticed that a number of products are systems which have FreeBSD or Linux at the heart under a nice shiny badge.
I thought I will put together a solution myself based on the same ingredients. The reason why is because I have realised that I have become dependent on main stream vendors to deploy solutions, and don’t always fully address the need. With the push to virtualisation, it would be good to have a powerful virtualised firewall just like the big boys. So he is what I have done so far.

High performance Ubuntu Firewall

If you run a webserver you will know that your webserver is scanned and probed from particular networks from originating from a hot-spot of countries. If your web application does not require then why not just block it.
Well it can prove expensive in terms of performance, to block a whole country can take 1000’s of rules (http://www.countryipblocks.net/). Well using this solution you can do things some of the big boys cant do ( Sonicwall !). Using iptables and IPset you can create 1000’s of rules and objects with impacting heavily on performance.
Iptables is already part of all Linux Distributions, However IPset is not. You have to install it and it can be a bit awkward. However it is a piece of cake in Ubuntu 10.04 LTS.

sudo apt-get install ipset ipset-source
m-a a-i ipset

Performing the previous commands will install the required kernel modules using module-assistant, and also the user space tools. You are know ready to create your very large firewall rules. This is so much easier than patching the kernel with patcho-matic and recompiling iptables. This is how you use it
Create your sets, you can get your network list from http://www.countryipblocks.net/ and write a script to generate the creation of the list.

ipset –create feckoff nethash
ipset –add feckoff 27.8.0.0/12
ipset –add feckoff 27.24.0.0/13
ipset –add feckoff 27.8.0.0/12
ipset –add feckoff 27.24.0.0/13
ipset –add feckoff 27.36.0.0/13
ipset –add feckoff 27.44.0.0/14
ipset –add feckoff 27.50.128.0/17
ipset –add feckoff 27.54.192.0/18
ipset –add feckoff 27.144.0.0/16
ipset –add feckoff 27.148.0.0/10
ipset –add feckoff 27.212.0.0/12
ipset –add feckoff 58.14.0.0/13
ipset –add feckoff 58.22.0.0/14
……. etc etc 100’s of subnets later you have added all your subnets, DONT MIX /32 networks or hosts

Now he comes the important bit. Now you have created your IPset you can now apply it to your rule base.

iptables -A INPUT -m set –set feckoff src -j DROP

You have just blocked 1000’s of subnets with one command in your ruleset
In an ideal world you would not really want to block a whole range of subnets like this, It is not the best use of resources. However there are times when this is required to increase security of you webserver against a particular type of attack.

Courtesy :  http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/

How to block huge amount of IP adresses

Sometime you need to block really big numbers of IP addresses. It could be for different reasons. For example, in case of password bruteforce, DDoS attack. Of course, you can block them just in iptables. But there can be a problem. If set of IP adresses contain thousands of items iptables perfomance decreases (actually, perfomance of netfilter, as soon as iptables is just a tool for managing firewall). Your CPU load can increase too. Fortunately there is a perfect solution – ipsets.
So here is a problem. You need to add thousand of IP to your firewall. In almost all cases there are random IPs from various network. Here we suppose you run Fedora 14 box so you don’t have to recompile kernel modules.
First of all you need to install xtables-addons. You can find it in RPM fusion repository.

yum install  xtables-addons

Next create ipset chain. We’ll call it autoban:

ipset -N autoban iphash ––hashsize 4096 ––probes 2 ––resize 50

Add it to your iptables chain. It can differ depending on your firewall settings. Here we use ethin chain.

iptables -I ethin 2 -p tcp -m multiport ––dport 80,443 -m set ––match-set autoban src -j DROP

Now you can add all bad IP to your ipset. For instance, you have text file called bots.txt with one IP per line. So you can add them to ipset using simple bash script:

for i in $( cat /tmp/bots.txt ) ; do ipset -A ban $i ; done

To check run:

ipset -L autoban

Save rules to config:

/etc/init.d/ipset save

Enable ipset startup script to load after reboot.

chkconfig ipset on

Note! To prevent blocking yourself you may add simple cron task:

*/5 * * * * ipset -F

In case you made some mistake it will flush all items from all ipsets.
Also you should know ipset supports different IP sets –– ipmap, macipmap, portmap, nethash and so on.
Refer to man ipset to choose which fit your requirements.
Starting with version 5.0 ipset supports IPv6. But Fedora 14 includes ipset 4.4.

Courtesy : http://supportex.net/2011/02/block-huge-amount-ip-adresses-ipset-fedora-14/

Using IP sets for best performance

IP sets are the best method for blocking specific countries using our IP prefix files for specific countries.
From the IPset homepage:

IP sets are a framework inside the Linux 2.4.x and 2.6.x kernel, which can be administered by the ipset utility. Depending on the type, currently an IP set may store IP addresses, (TCP/UDP) port numbers or IP addresses with MAC addresses in a way, which ensures lightning speed when matching an entry against a set.

If you want to

• store multiple IP addresses or port numbers and match against the collection by iptables at one swoop;
• dynamically update iptables rules against IP addresses or ports without performance penalty;

express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets

If you have a network or server with high traffic and using standard iptables for traffic blocking it may affect your server/network performance. With IPsets you can “group” multiple IP sets in groups and then match these in one swoop. This will provide you top performance.

IP sets allows you to bind an entry in a set to another set, which forms a relationship between the set element and the set it is bound to. The sets may have a default binding, which is valid for every set element for which there is no binding defined at all.

Example:

ipset -N servers ipmap –network 10.10.10.0/16
ipset -A servers 10.10.10.1
ipset -A servers 10.10.10.2
ipset -N ports portmap –from 1 –to 1024
ipset -A ports 21
ipset -A ports 22
ipset -A ports 25
ipset -B servers 10.10.10.2 -b ports
iptables -A FORWARD -m set –set servers dst,dst -j ACCEPT
iptables -A FORWARD -j DROP

Courtesy :  http://www.ipdeny.com/blog/using-ip-sets-for-best-performance/