paramah/ossec-blacklist
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

install into proper chains

Browse Source
This commit is contained in:
Pawel Krawczyk 2015-01-07 10:57:00 +00:00
parent 097a52fcad
commit f2b54af727
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
blacklist.sh
View File

@ -1,10 +1,8 @@
#!/bin/sh #!/bin/sh
# IP blacklisting script for Linux servers # IP blacklisting script for Linux servers
# Pawel Krawczyk https://keybase.io/kravietz # Pawel Krawczyk 2014-2015
# # documentation https://github.com/kravietz/blacklist-scripts
# This script should be installed as /etc/cron.daily/blacklist
# Emerging Threats lists offensive IPs such as botnet command servers # Emerging Threats lists offensive IPs such as botnet command servers
urls="http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt" urls="http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt"
@ -25,17 +23,29 @@ if [ -z "$(which curl)" ]; then
exit 1 exit 1
fi fi
if [ "$(which uci)" ]; then
# we're on OpenWRT
wan_iface=$(uci get network.wan.ifname)
IN_OPT="-i $wan_iface"
INPUT=input_rule
FORWARD=forwarding_rule
else
INPUT=INPUT
FORWARD=FORWARD
fi
# create main blocklists chain # create main blocklists chain
if ! iptables -L | grep -q "Chain ${blocklist_chain_name}"; then if ! iptables -L | grep -q "Chain ${blocklist_chain_name}"; then
iptables -N ${blocklist_chain_name} iptables -N ${blocklist_chain_name}
fi fi
# inject references to blocklist in the beginning of input and forward chains # inject references to blocklist in the beginning of input and forward chains
if ! iptables -L INPUT | grep -q ${blocklist_chain_name}; then if ! iptables -L ${INPUT} | grep -q ${blocklist_chain_name}; then
iptables -I INPUT 1 -j ${blocklist_chain_name} iptables -I ${INPUT} 1 ${IN_OPT} -j ${blocklist_chain_name}
fi fi
if ! iptables -L FORWARD | grep -q ${blocklist_chain_name}; then if ! iptables -L ${FORWARD} | grep -q ${blocklist_chain_name}; then
iptables -I FORWARD 1 -j ${blocklist_chain_name} iptables -I ${FORWARD} 1 ${IN_OPT} -j ${blocklist_chain_name}
fi fi
# flush the chain referencing blacklists, they will be restored in a second # flush the chain referencing blacklists, they will be restored in a second