iptables blocklist importer For Linux

iptables blocklist importer is a Python program to parse and import P2P-style IP range block lists into an iptables chain quickly and efficiently.

Create an empty chain in your iptables firewall named BadRanges (or edit the code to use another name if you prefer) and add an appropriate reference in your INPUT and/or FORWARD chains. If you're using this on a single host that doesn't act as a router, you'll not need an entry in FORWARD. Here's what I'm using:

iptables -N BadRanges iptables -I INPUT -i eth0 -m state --state NEW,RELATED -j BadRanges iptables -I FORWARD -i eth0 -m state --state NEW,RELATED -j BadRanges

The above assumes your external network adapter is called eth0. All new incoming connections, or packets related to existing connections will be checked against the BadRanges list. This will not filter outbound packets, and as such shouldn't prevent you from, for example, using a website hosted by an IP range that you don't want connecting back to you.

Now that our entries exist as above, save your iptables (which is iptables-save > /etc/sysconfig/iptables on Fedora at least) so it loads like this by default. As of the above, nothing is effectively different in how your firewall behaves. Now copy iptables-blocklist.py to /usr/local/libexec which parses the list into iptables-restore format and install zzz-badrangeupdate in your /etc/cron.daily or /etc/cron.weekly to regularly update and install the list.

The cron script downloads a zipped list of IP ranges to be blocked if it has changed since the last execution using wget. The list is then unzipped and a diff between the previous and current list is created simply for reference to see what has changed (although I could eventually parse this instead and reduce the amount of processing time required). The unzipped text list of IP ranges is then parsed by the iptables-blocklist.py program into a list of approximated subnets (some ranges given are not on exact subnet boundaries; IPy makes an encompassing subnet declaration that may block more or less IPs than you intend). This list is sorted into network prefix length order, shortest first, on the assumption that it will make for faster or easier matching, which may or may not be true. After this the sorted list is output in iptables-restore format, and piped through iptables-restore with the -n flag, effectively replacing the one BadRanges chain with a new one atomically.