Block IPs Of Country And Stop Hacker

Some times you want to break access of some IP from a country to your website, so how to stop him ?

Somebody told you use application mod_geoip with Apache and also more but this application isn't globally.If you use Apache to block IPs, still many ports are open to blocked country. So here i am going to tell you one another things which works with Linux OS for block IPs.

Here i am tell you about IPSet  for make object successful so i am starting with introduction of IPSET...


ipset is used to set up, maintain and inspect so called IP sets in the Linux kernel. Depending on the type of the set, an IP set may store IP(v4/v6) addresses, (TCP/UDP) port numbers, IP and MAC address pairs, IP address and port number pairs, etc. See the set type definitions below.
Iptables matches and targets referring to sets create references, which protect the given sets in the kernel. A set cannot be destroyed while there is a single reference pointing to it.

Feature of IPset:


1. Store Multiple IPs and Ports on the Table and doing matching at the working time.
2. Dynamic Update of IPs and Ports without low performance.

We will need the Source Code for install IPset on the Linux so for it always used Current Kernal. Mostaly the Kernel Source Code is found under  /usr/src/linux-<version> which access as
  /usr/src/linux-(uname -r) at shell.

There are two version of IPset available ...


For the new branch
linux kernel source code (version >= 2.6.34)
source of ipset: ipset-6.11.tar.bz2 (md5sum)
For the old branch
linux kernel source code (version >= 2.6.16 or >= 2.4.36)
source of ipset: ipset-4.5.tar.bz2 (md5sum)

 For Download Click Here

Installation Of IPset:

Open your Linux Terminal and follow the steps.

First Extract the ipset, here i am try ipset-4.5.tar.gz ....

>tar -xf ipset-4.5.tar.gz

Now going for change the directory to ipset-4.5....

>cd  ipset-4.5

Here i am consider the kernel source code available at /usr/src/linux-(uname -r) ,so i am going to compile ipset:

>make KERNEL_DIR=/usr/src/$(uname -r) IP_NF_SET_MAX=256 IP_NF_SET_HASHSIZE=1024

Here IP_NF_SET_MAX controls the maximum number of IPSets and IP_NF_SET_HASHSIZE set the default size for hash maps.

Now , i am going to install the IPset ,i thing you would know about  "sudo" or "su -c" ,lets run command...

>sudo make install        

or 

>su -c 'make install'

After installation you will be ready for Block IPs.

Creating IPsets and Add IPs :

See below command :

# ipset  -N  countries  nethash

First thing is here, above write command execute as root ,and this creates a ipset which name is 'country' of type 'nethash'  , i am explain it step wise step see....

'Countries'  each set can be found in ipset and start adding IP address to set.

'nethash' is a set type, if you want know more then going to here  http://ipdeny.com/

We had created set named "countries" , now start adding IPs address to the set ,if i want blocking china IPs so add IPs of this zone from here http://www.ipdeny.com/ipblocks/data/countries/cn.zone

Here i am use simple for-loop for get to retrieve zone files:

# for IP in $ (wget -0 - http://www.ipdeny.com/ipblocks/data/countries/cn.zone)

> do

> ipset -A countries $IP

>done

Now all the IPs are add in countries set if you want to add new IPs so i am tell you a nethash store up to 65535 address,if you want add more then make new set for these.

I think my this post very helpful for a website admin if you want know some more command and information then click below link:

http://ipset.netfilter.org/ipset.man.html 

http://www.ipdeny.com/ipblocks/data/countries/  (Sets of Country IP Zone)

http://ipset.netfilter.org/iptables.man.html 

Please given comment and tell me you like or not my this post.