Add IP blocklists

These are my notes I use, maybe other will find it useful.

The source for the script and config file:
trick77/ipset-blacklist

---

1. Pulldown the script

Code:

wget -O /usr/local/sbin/update-blacklist.sh https://raw.githubusercontent.com/trick77/ipset-blacklist/master/update-blacklist.sh

2. Make the script executible

Code:

chmod +x /usr/local/sbin/update-blacklist.sh

3. Create the directory for the config file and IP lists

Code:

mkdir -p /etc/ipset-blacklist ; wget -O /etc/ipset-blacklist/ipset-blacklist.conf https://raw.githubusercontent.com/trick77/ipset-blacklist/master/ipset-blacklist.conf

4. Add or comment out lists

Code:

vi /etc/ipset-blacklist/ipset-blacklist.conf

6. Run the script and start blocking the known bad guys. This will also create the IP set and insert the iptables rule.

Code:

/usr/local/sbin/update-blacklist.sh /etc/ipset-blacklist/ipset-blacklist.conf

Create the CSF post script to ensure this survives reboot.

Code:

vi /etc/csf/csfpost.sh

Paste:

Code:

#!/bin/bash
ipset restore < /etc/ipset-blacklist/ip-blacklist.restore
iptables -I INPUT 1 -m set --match-set blacklist src -j DROP

Then:

Code:

chmod +x /etc/csf/csfpost.sh

Restart CSF

Code:

csf -r

When finished you can watch to make sure it's working.

Code:

watch iptables -L -nv

Add cron

Code:

vi /etc/cron.d/update-blacklist

Paste:

Code:

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
33 08 * * * /usr/local/sbin/update-blacklist.sh /etc/ipset-blacklist/ipset-blacklist.conf