Score:0

Ubuntu

IPTABLES Prerouting, mass add

Kamil Skwirut

12/12/22, 10:25 AM

maybe someone know how can i mass add like 1 400 000 ip's to iptables with command:

iptables -I PREROUTING -t raw -d $ipban -j DROP

right now im using:

while read ipban
do
iptables -I PREROUTING -t raw -d $ipban -j DROP
done < ips.txt

But already it took more than 20 hours to add.

My vps is very small like 1gb ram and 1vcpu so its not that fast.

I tried to do iptables restore but i got few errors so im looking for fastest solution.

202

1 + 1

iptables

Doug Smythies

12/12/22, 1:38 PM

For large groups of IP addresses look into `ipset`.

Score:0

Ubuntu

Muhammed Özen

12/12/22, 1:17 PM

The script below should do what you need. Note that the name of the file from which you'll read the IPs is ips.txt in the script. You can replace it with your own file name.

#!/bin/bash

ip_addresses=$(cat ips.txt)

echo -n "" > iptables_configuration
echo "*raw" >> iptables_configuration
echo ":PREROUTING ACCEPT [0:0]" >> iptables_configuration
echo ":OUTPUT ACCEPT [0:0]" >> iptables_configuration

for i in $ip_addresses
do
echo -A PREROUTING -d $i/32 -j DROP >> iptables_configuration
done
echo "COMMIT" >> iptables_configuration

echo "*filter" >> iptables_configuration
echo ":INPUT ACCEPT [0:0]" >> iptables_configuration
echo ":FORWARD ACCEPT [0:0]" >> iptables_configuration
echo ":OUTPUT ACCEPT [0:0]" >> iptables_configuration
echo "-A INPUT -p tcp -m tcp --dport 25565 --tcp-option 8 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable" >> iptables_configuration
echo "COMMIT" >> iptables_configuration

cat iptables_configuration | iptables-restore
rm iptables_configuration

iptables -t raw -A PREROUTING -p tcp --dport 25565 -j ACCEPT
iptables -t raw -A PREROUTING -p tcp --dport 25565 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t raw -A PREROUTING -p tcp --dport 25565 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 150 --connlimit-mask 32 --connlimit-saddr -j DROP
iptables -t raw -A PREROUTING -p tcp --dport 25565 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 10 --connlimit-mask 32 --connlimit-saddr -j DROP

All you have to do is to execute the script where the ips.txt file is present. The rest will be handled by the script.

0 + 12

Kamil Skwirut

12/13/22, 6:15 AM

Problem is that i dont want to block ranges or subnets i Just want to block specified ip's from txt file.

Muhammed Özen

12/13/22, 11:32 AM

I understand now. I know the solution to your problem. The problem is every time you're adding a new rule, you're executing the iptables binary again. You have to write a configuration file that contains all the rules and you'll only execute iptables once to add all these rules. I've written a script for you that does what you need but when you apply the script, your existing iptables rules will be gone and the rules for banning the IP addresses in the file will be present only. If you want to include other rules, you have to modify iptables_configuration file to your needs. Check out my post.

Kamil Skwirut

12/14/22, 11:06 AM

Sure thing mate, i have rules like this: https://pastebin.com/MW4x9QNa If its possible make it use prerouting its more efficient :D Im very glad you want to help me and write such a big post!

Muhammed Özen

12/14/22, 1:51 PM

You're very welcome. But you have some variables in your script that you didn't define like $port and $limit_global_connections_max. If you give me their exact values, only then I can help

Kamil Skwirut

12/15/22, 2:55 PM

Sorry, i didint noticed that, here's working version https://pastebin.com/LxJvqF51 If you also know how to make them PREROUTING it would be awesome (it would be more efficient).

Kamil Skwirut

12/15/22, 3:51 PM

And can you explain me why theres`/32` in -A PREROUTING -d $i/32 -j DROP ?

Muhammed Özen

12/16/22, 12:25 AM

I just edited the post again. Now you don't even have to worry about iptables-restore. All you really have to is to run the script and it'll get everything ready for you. Also I put all the rules in PREROUTING chain except for one because it had invalid options for PREROUTING. As for your second question, /32 signifies only one single IP address in CIDR notation. If you specify any value apart from 32, it'll specify a subnet including more than one IP address. But since we only need to ban individual IP addresses and we don't want to block a subnet or a range of IPs, we need /32 here.

Kamil Skwirut

12/16/22, 7:19 PM

Thanks for help! I did everything like you said and its working!

Muhammed Özen

12/16/22, 7:51 PM

You're welcome mate. I'm glad that I could be of help :)

Kamil Skwirut

12/17/22, 6:58 AM

The problem i found right now is that when i applied everything my internet speed goes to 5Mb/s from 1gbs

Muhammed Özen

12/17/22, 9:22 AM

I believe the reason for that is you have many rules. As you said you had so many rules that it was taking a lot of time to register them all in the firewall. Whenever a network packet hits your computer, kernel compares it with every single rule in the firewall. And if it gets a pass from all of these rules, then you get your connection in local TCP/UDP stack. The more rules you have in your firewall, the slower the connection is going to be. You have to keep the balance right between security and network speed

Kamil Skwirut

12/17/22, 9:55 AM

Yeah, i asked my host for help and they said will block those ip's anyways. Thank you for help !

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: IPTABLES Prerouting, mass add

TH: IPTABLES กำหนดเส้นทางล่วงหน้า เพิ่มจำนวนมาก

RO: IPTABLES Prerouting, adaos de masă

RU: IPTABLES Предварительная маршрутизация, массовое добавление

VI: IPTABLES Định tuyến trước, thêm hàng loạt

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.