Table of Contents
Compile and install:
1. Dependency environment:
2. Compile and install ipset (linux kernel source code (version >= 2.6.32) )
Automatic IP address disabling
Home Operation and Maintenance Linux Operation and Maintenance Case study on how to block malicious IP addresses in batches to prevent attacks under Linux

Case study on how to block malicious IP addresses in batches to prevent attacks under Linux

Jun 07, 2017 am 10:28 AM

In many cases, you may need to block IP addresses under Linux. For example, as an end user, you may want to be protected from spyware or IP tracking. If you are a system administrator, you may want to ban spam IP addresses from accessing your corporate mail server. Or you want to ban certain countries from accessing your web service for some reason. In many cases, however, your IP address blocking list can quickly grow to tens of thousands of IPs. How to deal with this?

Solution: ipset + iblocklist2ipset

Installation:

The simplest method is to install yum, but the version of this method is relatively low and lacks some used module parameters, so it is not recommended;

yum install ipset -y
Copy after login

Compile and install:

1. Dependency environment:

yum install libmnl libmnl-devel kernel-devel libtool-devel -y
Copy after login

(Installation method of new version: git pull git://git.netfilter.org/libmnl.git run ./autogen.sh)

(Note: If only libmnl is installed, the following error will appear:

checking for libmnl... configure: error: Package requirements (libmnl >= 1) were not met:
No package 'libmnl' found
Consider adjusting the PKG_CONFIG_PATH environment variable if you
installed software in a non-standard prefix.
Alternatively, you may set the environment variables libmnl_CFLAGS
and libmnl_LIBS to avoid the need to call pkg-config.
See the pkg-config man page for more details.
)
Copy after login

may prompt that /lib/modules/2.6.32- cannot be found during compilation) 431.el6.x86_64/source

After investigation, it was found that this soft link/lib/modules/2.6.32-431.el6.x86_64/build -->/usr/src/kernels/2.6.32- 431.el6.x86_64 does not exist

Solution: Re-establish the soft connection

ln -sb /usr/src/kernels/2.6.32-573.3.1.el6.x86_64 /lib/modules/2.6.32-431.el6.x86_64/build
Copy after login

Error when running ./autogen.sh:

Cannot find /usr/share /libtool/

Solution: Install the libtool-devel tool package yum install libtool-devel

2. Compile and install ipset (linux kernel source code (version >= 2.6.32) )

wget -P /usr/local/src http://ipset.netfilter.org/ipset-6.26.tar.bz2
cd /usr/local/src && tar xjf ipset-6.26.tar.bz2 && cd ipset-6.26
./autogen.sh
./configure
make
make modules
make install 
make modules_install
Copy after login

Note: Different linux kernels use different versions of source code packages

Note: linux kernel source code (version >= 2.6.16 or >= 2.4.36)

Compile and install:

wget -P /usr/local/src http://ipset.netfilter.org/ipset-4.5.tar.bz2
cd /usr/local/src && tar xf ipset-4.5.tar.bz2 && cd ipset-4.5
make KERNEL_DIR=http://img.xue163.com/lib/modules/$(shell uname -r)/build     #$(shell uname -r)使用shell命令获取
make KERNEL_DIR=http://img.xue163.com/lib/modules/$(shell uname -r)/build install
Copy after login

Commonly used commands:

ipset list 查看ip集列表信息
ipset create pythontab hash:ip maxelem 1000000  创建一个IP集pythontab,指定类型为hash:ip,设置ip集最多存储IP数为1000000
ipset add pythontab X.X.X.X  增加一个ip地址到IP集pythontab中去
ipset add pythontab X.X.X.X/24  增加一个网段到IP集pythontab中去
ipset dell pythontab X.X.X.X   删除IP集中指定的IP地址
ipset list 查看当前所有list
ipset save pythontab -f pythontab.txt  将IP集pythontab中的信息保存到当前文件目录下面的文件pythontab.txt中
ipset destroy pythontab   删除指定的IP集pythontab  
ipset restore -f pythontab.txt  将保存的pythontab.txt文件中的IP集信息重新导入到ipset中
其他命令参考 ipset --help
iptable命令参考:
iptables -I INPUT -m set --match-set pythontab src -p tcp --destination-port 80 -j DROP #拒绝ipset IP集pythontab中的地址访问服务器的80端口
service iptables save
service iptables restart
Copy after login

Automatic IP address disabling

Now you should see the power of maintaining IP blacklists. A tedious and time-consuming task. In fact, there are many free or paid services that can do this for you. As an added bonus, let's look at how to automatically add IP blacklists to the IP set. ##First let’s get a free blacklist from iblocklist.com

Next I’m going to use an open source Python tool called iblocklist2ipset to convert the blacklist into an IP set.

First, you need to install pip

Use the following command to install iblocklist2ipset.

$ pip install iblocklist2ipset
Copy after login

On some distributions such as Fedora, you may need to run:

$ python-pip install iblocklist2ipset
Copy after login

Now go to iblocklist.com and grab the URL of any P2P list (such as the "level1" list).

Download and unzip it, then save it as a txt file, for example, called pythontab.txt. Because iblocklist2ipset only supports url to obtain the list, put pythontab.txt in any directory of your website. For example: ipset directory

$ iblocklist2ipset generate --ipset pythontab "http://www.pythontab.com/ipset/pythontab.txt" > pythontab.txt
Copy after login

After running the above command, you will get a file named pythontab.txt. If you view its contents, you will see something like this:

create pythontab hash:net family inet hashsize 131072 maxelem 237302
add pythontab 1.2.4.0/24
add pythontab 1.2.8.0/24
add pythontab 1.9.75.8/32
add pythontab 1.9.96.105/32
add pythontab 1.9.102.251/32
add pythontab 1.9.189.65/32
Copy after login

You can load this file with the following ipset command:

$ ipset restore -f pythontab.txt
Copy after login

You can now view the automatically created IP set:

$ ipset list pythontab
Copy after login

This saves you the trouble of manual management.

Note that the version installed using yum under centos is not the latest version. It may not support the -f parameter and import the blacklist file, so it is recommended to use the source code package to install the latest version

The above is the detailed content of Case study on how to block malicious IP addresses in batches to prevent attacks under Linux. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. Best Graphic Settings
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. How to Fix Audio if You Can't Hear Anyone
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
WWE 2K25: How To Unlock Everything In MyRise
1 months ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

What is Linux actually good for? What is Linux actually good for? Apr 12, 2025 am 12:20 AM

Linux is suitable for servers, development environments, and embedded systems. 1. As a server operating system, Linux is stable and efficient, and is often used to deploy high-concurrency applications. 2. As a development environment, Linux provides efficient command line tools and package management systems to improve development efficiency. 3. In embedded systems, Linux is lightweight and customizable, suitable for environments with limited resources.

How to start apache How to start apache Apr 13, 2025 pm 01:06 PM

The steps to start Apache are as follows: Install Apache (command: sudo apt-get install apache2 or download it from the official website) Start Apache (Linux: sudo systemctl start apache2; Windows: Right-click the "Apache2.4" service and select "Start") Check whether it has been started (Linux: sudo systemctl status apache2; Windows: Check the status of the "Apache2.4" service in the service manager) Enable boot automatically (optional, Linux: sudo systemctl

What to do if the apache80 port is occupied What to do if the apache80 port is occupied Apr 13, 2025 pm 01:24 PM

When the Apache 80 port is occupied, the solution is as follows: find out the process that occupies the port and close it. Check the firewall settings to make sure Apache is not blocked. If the above method does not work, please reconfigure Apache to use a different port. Restart the Apache service.

How to monitor Nginx SSL performance on Debian How to monitor Nginx SSL performance on Debian Apr 12, 2025 pm 10:18 PM

This article describes how to effectively monitor the SSL performance of Nginx servers on Debian systems. We will use NginxExporter to export Nginx status data to Prometheus and then visually display it through Grafana. Step 1: Configuring Nginx First, we need to enable the stub_status module in the Nginx configuration file to obtain the status information of Nginx. Add the following snippet in your Nginx configuration file (usually located in /etc/nginx/nginx.conf or its include file): location/nginx_status{stub_status

How to start monitoring of oracle How to start monitoring of oracle Apr 12, 2025 am 06:00 AM

The steps to start an Oracle listener are as follows: Check the listener status (using the lsnrctl status command) For Windows, start the "TNS Listener" service in Oracle Services Manager For Linux and Unix, use the lsnrctl start command to start the listener run the lsnrctl status command to verify that the listener is started

How to set up a recycling bin in Debian system How to set up a recycling bin in Debian system Apr 12, 2025 pm 10:51 PM

This article introduces two methods of configuring a recycling bin in a Debian system: a graphical interface and a command line. Method 1: Use the Nautilus graphical interface to open the file manager: Find and start the Nautilus file manager (usually called "File") in the desktop or application menu. Find the Recycle Bin: Look for the Recycle Bin folder in the left navigation bar. If it is not found, try clicking "Other Location" or "Computer" to search. Configure Recycle Bin properties: Right-click "Recycle Bin" and select "Properties". In the Properties window, you can adjust the following settings: Maximum Size: Limit the disk space available in the Recycle Bin. Retention time: Set the preservation before the file is automatically deleted in the recycling bin

How to restart the apache server How to restart the apache server Apr 13, 2025 pm 01:12 PM

To restart the Apache server, follow these steps: Linux/macOS: Run sudo systemctl restart apache2. Windows: Run net stop Apache2.4 and then net start Apache2.4. Run netstat -a | findstr 80 to check the server status.

How to optimize the performance of debian readdir How to optimize the performance of debian readdir Apr 13, 2025 am 08:48 AM

In Debian systems, readdir system calls are used to read directory contents. If its performance is not good, try the following optimization strategy: Simplify the number of directory files: Split large directories into multiple small directories as much as possible, reducing the number of items processed per readdir call. Enable directory content caching: build a cache mechanism, update the cache regularly or when directory content changes, and reduce frequent calls to readdir. Memory caches (such as Memcached or Redis) or local caches (such as files or databases) can be considered. Adopt efficient data structure: If you implement directory traversal by yourself, select more efficient data structures (such as hash tables instead of linear search) to store and access directory information

See all articles