Home > Article > Operation and Maintenance > Case study on how to block malicious IP addresses in batches to prevent attacks under Linux
In many cases, you may need to block IP addresses under Linux. For example, as an end user, you may want to be protected from spyware or IP tracking. If you are a system administrator, you may want to ban spam IP addresses from accessing your corporate mail server. Or you want to ban certain countries from accessing your web service for some reason. In many cases, however, your IP address blocking list can quickly grow to tens of thousands of IPs. How to deal with this?
Solution: ipset + iblocklist2ipset
The simplest method is to install yum, but the version of this method is relatively low and lacks some used module parameters, so it is not recommended;
yum install ipset -y
yum install libmnl libmnl-devel kernel-devel libtool-devel -y
(Installation method of new version: git pull git://git.netfilter.org/libmnl.git run ./autogen.sh)
(Note: If only libmnl is installed, the following error will appear:
checking for libmnl... configure: error: Package requirements (libmnl >= 1) were not met: No package 'libmnl' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables libmnl_CFLAGS and libmnl_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. )
may prompt that /lib/modules/2.6.32- cannot be found during compilation) 431.el6.x86_64/source
After investigation, it was found that this soft link/lib/modules/2.6.32-431.el6.x86_64/build -->/usr/src/kernels/2.6.32- 431.el6.x86_64 does not exist
Solution: Re-establish the soft connection
ln -sb /usr/src/kernels/2.6.32-573.3.1.el6.x86_64 /lib/modules/2.6.32-431.el6.x86_64/build
Error when running ./autogen.sh:
Cannot find /usr/share /libtool/
Solution: Install the libtool-devel tool package yum install libtool-devel
wget -P /usr/local/src http://ipset.netfilter.org/ipset-6.26.tar.bz2 cd /usr/local/src && tar xjf ipset-6.26.tar.bz2 && cd ipset-6.26 ./autogen.sh ./configure make make modules make install make modules_install
Note: Different linux kernels use different versions of source code packages
Note: linux kernel source code (version >= 2.6.16 or >= 2.4.36)
Compile and install:
wget -P /usr/local/src http://ipset.netfilter.org/ipset-4.5.tar.bz2 cd /usr/local/src && tar xf ipset-4.5.tar.bz2 && cd ipset-4.5 make KERNEL_DIR=http://img.xue163.com/lib/modules/$(shell uname -r)/build #$(shell uname -r)使用shell命令获取 make KERNEL_DIR=http://img.xue163.com/lib/modules/$(shell uname -r)/build install
Commonly used commands:
ipset list 查看ip集列表信息 ipset create pythontab hash:ip maxelem 1000000 创建一个IP集pythontab,指定类型为hash:ip,设置ip集最多存储IP数为1000000 ipset add pythontab X.X.X.X 增加一个ip地址到IP集pythontab中去 ipset add pythontab X.X.X.X/24 增加一个网段到IP集pythontab中去 ipset dell pythontab X.X.X.X 删除IP集中指定的IP地址 ipset list 查看当前所有list ipset save pythontab -f pythontab.txt 将IP集pythontab中的信息保存到当前文件目录下面的文件pythontab.txt中 ipset destroy pythontab 删除指定的IP集pythontab ipset restore -f pythontab.txt 将保存的pythontab.txt文件中的IP集信息重新导入到ipset中 其他命令参考 ipset --help iptable命令参考: iptables -I INPUT -m set --match-set pythontab src -p tcp --destination-port 80 -j DROP #拒绝ipset IP集pythontab中的地址访问服务器的80端口 service iptables save service iptables restart
Now you should see the power of maintaining IP blacklists. A tedious and time-consuming task. In fact, there are many free or paid services that can do this for you. As an added bonus, let's look at how to automatically add IP blacklists to the IP set. ##First let’s get a free blacklist from iblocklist.com
Next I’m going to use an open source Python tool called iblocklist2ipset to convert the blacklist into an IP set.
First, you need to install pip
Use the following command to install iblocklist2ipset.
$ pip install iblocklist2ipset
On some distributions such as Fedora, you may need to run:
$ python-pip install iblocklist2ipset
Now go to iblocklist.com and grab the URL of any P2P list (such as the "level1" list).
Download and unzip it, then save it as a txt file, for example, called pythontab.txt. Because iblocklist2ipset only supports url to obtain the list, put pythontab.txt in any directory of your website. For example: ipset directory
$ iblocklist2ipset generate --ipset pythontab "http://www.pythontab.com/ipset/pythontab.txt" > pythontab.txt
After running the above command, you will get a file named pythontab.txt. If you view its contents, you will see something like this:
create pythontab hash:net family inet hashsize 131072 maxelem 237302 add pythontab 1.2.4.0/24 add pythontab 1.2.8.0/24 add pythontab 1.9.75.8/32 add pythontab 1.9.96.105/32 add pythontab 1.9.102.251/32 add pythontab 1.9.189.65/32
You can load this file with the following ipset command:
$ ipset restore -f pythontab.txt
You can now view the automatically created IP set:
$ ipset list pythontab
This saves you the trouble of manual management.
Note that the version installed using yum under centos is not the latest version. It may not support the -f parameter and import the blacklist file, so it is recommended to use the source code package to install the latest versionThe above is the detailed content of Case study on how to block malicious IP addresses in batches to prevent attacks under Linux. For more information, please follow other related articles on the PHP Chinese website!