tlhackque / blockcountries

iptables manager for IP blocking by country

BlockCountries

iptables manager to block by country

Copyright (C) 2010, 2012, 2013, 2015, 2016 Timothe Litt

BlockCountries generates iptables and ipv6tables that allow blocking IP traffic based on the country that the IP address is assigned to by the issuing NIC.

This may or may not be where the traffic actually originates (Tunnels, proxies, etc), but it ususally is. It has proven effective for me.

It supports both IPv4 and IPv6 addresses. It is highly configurable, allowing you to block a country but allow access to some ports, or to only block all countries except those that you wish to permit. There are other options.

BlockCountries obtains the IP address data from the NICs.

The generated iptables are optimized for chain length, generating subchains when it is advantageous.

BlockCountries can (and should) be run as a cron job to get updates to the IP address allocations, and as an initscript at system startup.

If configured to log rejected connections, it will produce some simple reports of the intercepts by host IP, showing the country, protocols, ports and number of attempts.

It is a Perl script.

#Latest updates:

V2.22 Correct script permissions in git

V2.21 Provide additional detail when unable to get data from RIR

V2.20 Include zone data summary in debug log.

V2.19 Log iptables version in debug data. Correct IPv6 error in 2.18.

V2.18 Debug determinisim to make comparing logs easier.

V2.17 Add -noprotect & some more debugging improvements.

V2.16 more bcinstall improvements. Only inspect protocol config if enabled.

V2.15 bcinstall improvements. iptables-restore format debug data.

V2.14 Cosmetic logging improvements

V2.13 Add Zip compression to debug log. Log start and stop to syslog.

V2.12 Rewrite debug logging and gather more data for debugging.

V2.11 Improve debug logging. bcinstall reports all problems at once, provides more detail.

V2.10 Add Default-Start and Default-Stop to LSB block

V2.9 Simplify configuration so it's not necessary to modify the script. Improve documentation and packaging. bcinstall checks for minimum versions and iptables configuration.

V2.8 Add $LOGLEVEL to control syslog priority

V2.7 Add LSB init block

V2.6 Add version command. Syntax cleanup. Corner case fix for help.

V2.5 Fix uninitialized variable when no command arguments specified.

V2.4 Documentation updates, no functional changes.

• Clarify -permitonly and rules placement/priorities

V2.3 Make conntrack optional - older netfilters are still around

• Use -conntrack if you see warnings (or errors)
• Add -passive to use passive FTP connection when getting registry data. This usually traverses firewalls more easily.

V2.2 Support conntrack instead of state

V2.1 Support new statistics file used by registries

#Dependencies: The script uses a number of Perl library modules, available from CPAN (or in the base Perl distribution). The bcinstall bash script should be used whenever a new version of BlockCountries is installed to determine whether they (and Perl) are installed.

bcinstall will also verify that the minimum required version of each module is installed. Later versions should be used if available.

There are known bugs that impact BlockCountries in earlier versions of several modules. Don't try to use any version less than the minimum that bcinstall checks for.

#Cautions:

Consider carefully whether you want to use this software and the full consequences to your site and/or business. By necessity, it will block potential customers and 'good' connections along with villains. You must consider the costs and benefits to your operation - the author does not endorse any specific policy. In particular, the defaults should be viewed as examples, not value judgements.

The IPv6 optimizations have not been tuned; it is not clear what the right subchain structure is.

#Installation:

Unpack the tar.gz or zip file that you downloaded from github. (tar.gz files are available from https://github.com/tlhackque/BlockCountries/releases)

This will create a subdirectory named BlockCountries-.

cd to that directory.

Run bcinstall (see its README) to check that Perl and its dependencies are installed and meet the minimum version requirements.

Copy BlockCountries to /etc/init.d (or your distributions startup directory) run chkconfig, systemctl enable, update-rc.d (or equivalent) to include it in the automatic system startup.

If Perl is not installed in /usr/bin, create a softlink to it there, bcinstall will provide guidance.

On Unix-like systems,

which perl

will usually reveal the location.

The file config/BlockCountries should be copied to your distribution's configuration directory, such as /etc/sysconfig or /etc/default.

BlockCountries looks for the configuration file in several common directories, Use BlockCountries help for a list.

If you must place the configuration file in an alternate location, define the environment variable BlockCountriesCFG in all the environments where BlockCountries will be run. (cron, startup, and interactive) This is the first file attempted.

Inspect the first few lines of the configuration file and modify the variables in Section 1 for your environment.

Verify that BlockCountries finds your file by using BlockCountries config

Add a crontab entry similar to:

CRONJOB=1
11 23 * * Sun /etc/init.d/BlockCountries start -update

Please pick a different time. Note that IP address allocations are fairly stable; updating more than once a week is rarely productive.

Run

BlockCountries start -update

The filter should download the latest IP country assignments and be in place.

#Usage:

The usage as of V2.4 follows (the words prefixed by $ are filled in at runtime). Later versions differ - the definitive version, which is customized for your system, is available from:

$prog help

The following usage provides an introduction to BlockCountries.

Please do not use this version of the usage to configure BlockCountries for production; use the version from the help command, which is always up-to-date with the latest functions and clarifications.

IP filter manager for country filters

Usage: $prog command args
  config             Display active configuration file
  status [-v]        Display filter status.
                     -v provides configuration from config file
                     and command file - NOT iptables.
  list               List available country names/codes.
                     Contacts server for list.
  intercepts [-host name] [-days n]
                     List today's intercepts by host from $LOG.
                     Requires -log to start.
  stop  args         Stop filtering
  restart  args      Synonym for start (reloads with no open window)
  condrestart args   Restarts only if already running
  start args         Starts filter

Start uses tables of IP blocks assigned to country codes that are
stored in $ZONEDIR, which will be created if necessary.  The country
files are binary, and are only created for country codes that are
filtered.  The data is obtained from the Regional Internet Registries
when absent, or when start -update is specified.

iptables filters are generated and installed by start.  The filters are
optimized and generally will not look identical to the input data.  However
they will match the same address (no more and no fewer.)

Arguments for start-class commands are:
 -update            Get latest IP allocation data from regional registries.
                    Otherwise, only gets data if no local file exists for a registry.
 -4 -ipv4           Install filter for IPv4 addresses \ Default is -4 override with -no4 -no6
 -6 -ipv6           Install filter for IPv6 addresses / For both, use -4 -6
 -conntrack         Use -m conntrack rather than -m state to avoid warnings from newer iptables
 -log               Install a logging rule to log rejected packets.
 -nolog             Don't install a logging rule. (default)
 -nolimit           Do not limit logging (can generate huge log files if under attack; not advised)
 -limit spec        Limit logging, default = $loglimits[0]:$loglimits[1] (see man iptables "limit")
 -atport n          Allow connections to TCP port n even FROM banned addresses.
                    May specify any number of times.  May use a service name.
 -auport n          Allow connections to UDP port n even FROM banned addresses.
                    May specify any number of times.  May use a service name.
 -atporto n         Same as -atport, but for connections TO banned addresses.
 -auporto n         Same as -auport, but for connections TO banned addresses.
 -aip ip(/mask)    Allow connection from an otherwise banned IP address.
                    For a block, specify a netlength or mask. A hostname may
                    also be specified.  May specify any number of times.
 -dip ip(/mask)    Deny connections from an otherwise allowed IP address.
                    Same syntax as -aip.
 -passive           When using FTP for updates, use passive mode (traverse firewalls)
 -permitonly        Listed countries will be permited, all others denied.
                    Put in -permitonly in the configuration file so status and start are consistent.
 -blockout          Also generate rules to block output & forwarded-output.
                    This is probably not required for most applications, and
                    will roughly double the memory requirements.
                    Caution: If you use -blockout for start, you must also use it for stop.
                    This will not be a problem if it's in the configuration file.
 -d                 Output random debugging messages
 -v                 Output extended status/statistics
  CC                ISO Country code or name to ban (or permit if -permitonly).
                    Specify as many as you like.
                    Default list:

Arguments may also be obtained from the configuration file,
The configuration file must be readable but not
executable.  It is searched for in a number of places. See
BlockCountries help for a list.  The first file found is used:

The system configuration is specified by the variables:
 -logfile    "/var/log/messages*"  # Wildcard should include rotated/archived/.gz compressed files
                                   # containing iptables log messages
 -loglevel number or name          # syslog message priority.  Normally omitted. System-dependent.
                                   # Usually 0-6 (or as names, EMERGENCY, ALERT, CRITICAL,ERROR,
                                   # WARNING,NOTICE,INFORMATIONAL, or DEBUG)
 -logpfx '[Blocked CC]:'           # Prefix used for log messages from BlockedCountries
 -logpgm 'kernel'                  # Program name used by netfilter.  Always 'kernel'.
 -path   '/sbin'                   # Path for iptables components
 -zonedir '/root/blockips'         # Directory used to hold IP mapping data

The defaults are indicated above.  These variables can NOT be specified on the command line.

Anything else (except comments) contained in it is prepended to every command
line's arguments.

Use single or double-quoted strings for country names containining spaces.

This script is designed to run as a service; depending on your distribution
`chkconfig`, `update-rc.d`, or `system-ctl enable` will link it into
`/etc/rcN.d/.`  Be sure to put all configuration in the configuration file,
since startup scripts only get "start" (or "stop") as an argument.

This script should also be run with start -update from a cron job - weekly
is suggested - to obtain the latest IP address databases.  If the CRONJOB
environment variable is set, only errors and zone updates will be reported.
This is recomended to minimize e-mail from cron.

To prevent communications from banned IP addresses during updates,
start will install new rules before removing active rules.  For
this to be effective, you should not stop the service.

The status -v command will report the current configuration, although the
actual implementation in iptables will be different due to optimizations.

Rules are applied to the INPUT, OUTPUT or FORWARD chains after any existing
IPTABLES rules.  Typically, this means that related and established connections
are accepted before BlockCountries rules are applied, and icmp packets are
allowed.  (This varies by distribution and local option.)  To control
placement, define the corresponding -HOOK chain.(e.g. INPUT-HOOK) and call it
it from the main chain(s).  BlockCountries rules will be installed in
the -HOOK chain instead of the main chain.

When manual configuration directives are used, the rules are applied in the
following order (first match determines result):
   -atports (or -atportso) are accepted
   -auports (or -auportso) are accepted
   -aips are accepted
   -dips are denied
   Country constraints deny or accept (per -permitonly)
   IPTABLES rules later in the caller's chain
If a BlockCountries rule denies a connection, it will be dropped (and logged).
If a BlockCountries rule "accepts" a connection, it is still subject to any
IPTABLES rules that follow it.

To view the actual iptables configuration, use
    $IPT4 -nvL --line-number | less for IPV4 or
    $IPT6 -nvL --line-number | less for IPV6

start -v will provide some statistics for the optimizations and generated rules.

The intercepts command will parse $LOG and summarize intercepts by IP address.
It will break down the dropped packets by protocol(s) and port(s).  Of course,
logging must be on for this to work.  -days specifys how many days back
(from the current time) to read.  -host specifies the hostname to match.
Default -days is 1, hostname is current host.

Credits:
 Some ideas came from http://www.cyberciti.biz/faq/block-entier-country-using-iptables/.

 This version of the script merges all the IP address blocks; this saves over 1,000
 rules for the default banned address list.  It's also somewhat faster than a shell
 script, and contains a more complete and polished user and system interface.  It is
 not a complete superset; at this time it does not implement file archiving (better
 left to your backup solution) nor does it implement interface selection (better done
 with your own firewall rules and placement of the *-HOOK chains.)

Issues:
 Consider carefully whether you want to use this software and the full consequences
 to your site and/or business.  By necessity, it will block potential customers and
 'good' connections along with villains.  You must consider the costs and benefits
 to your operation - the author does not endorse any specific policy.  In particular,
 the defaults should be viewed as examples, not value judgements.

 Very large numbers of exception IP blocks might benefit from implementing a subchain
 structure - but that would be a rather different use model.  The known use cases
 would probably be penalized - so one would want to make a dynamic choice.  I'd
 want to see actual data before implementing this.

 The iptables-restore format is undocumented, though used by others.  It may be
 fragile.

 --tlhackque 1-Aug-2010, 8-Nov-2010, 3-Oct-2012, 4-Sep-2013, 17-Dec-2015, 5-Feb-2016

#Bug reports and suggestions

Please raise bug reports or suggestions at http://github.com/tlhackque/BlockCountries/issues.

Always include BlockCountries version BlockCountries config, and perl --version. If there is any error or warning message, include the full terminal session.

Suggestions and/or praise are also welcome.