Linux Iptables Just Block By Country

Fantastic! Thanks Vivek and David P.

I’ve been using fail2ban for years and it works great. I’ve noticed, however, that when fail2ban blocks an IP from say China, often over the next hour or so, more from the same country will be blocked. It appears that the probes or attacks are coordinated. So, if they figure out my fail2ban thresholds, they could sustain an attack for quite some time. This script will be a perfect addition!

David, when I add the following line per your updated post (fixing the smartquotes when pasted of course)

printf “%s $CBLIST -m state –state RELATED,ESTABLISHED -j ACCEPT\n” “-I”>> ${IPTCBRESTORE}.tmp

I get the below error. Removing that line allows the script to function properly. Any ideas? Using Centos 4.8 32bit.

Adding rule for 223.255.0.0/17 to chain for octet 223
Bad argument `–state’
Error occurred at line: 54
Try `iptables-restore -h’ or ‘iptables-restore –help’ for more information.
Country block instituted for: cn

Thanks again! Most excellent!

Reply

I hate to see anyone suffering a DDOS attack.

Here is a new version of the perl script. It has received only very limited testing, but I hope it will help your defense.

You don’t need programming knowledge of Perl to install/use this script, but you do need to know how to install CPAN modules. Some distributions provide many of the modules under yum, apt-get, etc. If yours doesn’t – or doesn’t have one that this needs, use cpan. There should be a cpan command installed with Perl. Just say cpan to the shell, then install modulename (like IO::Uncompress::Gunzip) and it should just work. ‘quit’ exits cpan. To find which modules are missing, run the script (e.g. /etc/init.d/BlockCountries help). If you get an error like “Can’t locate IO/Uncompress/Gunzip.pm in @INC….BEGIN failed–compilation aborted”, you need “IO::Uncompress::Gunzip” – you changed ‘/’ to “::” and drop the “.pm” to get the module name. Repeat for each missing module until you see the help display.

Don’t blindly install all the modules in the list, because if your distribution mechanism supplied a module, you want the distribution to handle updates.

See my post #65 for additional instructions and the sample configuration file.

Good luck!

Changes:

-permitonly inverts the country list – that is, listed countries are permitted, all others are denied.

-limit will limit the logging rate (see help for details) There is a default; use
-nolimit to get the old behavior

-dip will allow you to deny specific hosts/networks

The blocking chain will be inserted into the INPUT-HOOK chain if it exists, otherwise INPUT. (This allows more flexibility in when country blocking happens, particularly when multiple iptables-based tools all think they want to be ‘first’.)

#!/usr/bin/perl
#
# BlockCountries     Block IP traffic from specified countries
#
# chkconfig: 2345 10 92
# description:  Blocks IP traffic from IP addresses assigned to specific countries
#
use strict;
use warnings;
# Version 1.2
#
# Copyright (c) 2010 Timothe Litt, litt__at__acm_dot_org
#  All rights reserved.
#
# This software is licensed under the terms of the Perl
# Artistic License (see http://dev.perl.org/licenses/artistic.html).
#
# This is free software - it works for me, and it may (or may not)
# work for you.  No warranty or support is provided.
#
# Consider carefully whether you want to use this software
# and the full consequences to your site and/or business.
#
# This is written as a technical means to assist in implementing
# your policy.  The author expressly disclaims any responsibility
# for the consequences of using this software.
### Block all traffic from specified countries. ###
#
# See Usage() for documentation
#
# List of country codes - specify yours in the config file
my @DEFAULT_ISO = qw /cn kr kp kz ru/;
# Local configuration
my $IPT = '/sbin/iptables';
my $IPTR = '/sbin/iptables-restore';
my $GREP = '/bin/grep';
my $CFGFILE = '/etc/sysconfig/BlockCountries';
my $ZONEDIR = '/root/blockips';
my $ZONETBL = "$ZONEDIR/tables.ipt";
my $BLOCKURL = 'http://www.ipdeny.com/ipblocks/data/countries';
my $LOGPFX = '[Blocked CC]: ';
my $LOG = '/var/log/messages*';  # Note: This is a wildcard to handle log rotation.  .gz files will decompressed on the fly and processed.
my $LOGPGM = 'kernel';
my $IHOOK = 'INPUT-HOOK';       # Note: if this table is not found, INPUT will be used
#my $OHOOK = 'OUTPUT-HOOK';     # Note: if this table is not found, OUTPUT will be used
#my $FHOOK = 'FORWARD-HOOK';    # Note: if this table is not found, FORWARD will be used
# ### End of configuration
# The following are either part of base perl, or available on CPAN
use File::Basename;
use File::Path;
use IO::Uncompress::Gunzip;
use Locale::Country;
use LWP::Simple;
use NetAddr::IP;
use Net::Domain;
use Parse::Syslog;
use POSIX;
use Text::ParseWords;
# Changelog
# 1.0       Initial development
# 1.1       Add support for hook tables
# 1.2       By unpopular demand, add -permitonly
#           Add logging rate limit
#           Add -dip (deny IP)
umask 0137;
my $prog = basename $0;
# new, old
my @IPCHAINS = ( 'BLOCKCC0', 'BLOCKCC1' );
@IPCHAINS = reverse( @IPCHAINS ) if( system( "$IPT -n -L $IPCHAINS[0] >/dev/null 2>&1" ) == 0 );
my $IPNEWCHAIN = $IPCHAINS[0];
my $IPOLDCHAIN = $IPCHAINS[1];
$IHOOK = 'INPUT' unless( system( "$IPT -n -L $IHOOK >/dev/null 2>&1" ) == 0 );
#$OHOOK = 'OUTPUT' unless( system( "$IPT -n -L $OHOOK >/dev/null 2>&1" ) == 0 );
#$FHOOK = 'FORWARD' unless( system( "$IPT -n -L $FHOOK >/dev/null 2>&1" ) == 0 );
if( -e $CFGFILE ) {
    open( my $fh, '<', $CFGFILE ) or die( "Can't open $CFGFILE:$!" );
    while(  ) {
        s/\s*#.*$//;
        s/^\s+//;
        s/\s+$//;
        next unless length;
        push @ARGV, parse_line( '\s+', 0, $_ );
    }
    close $fh;
}
my $cmd = shift;
# Collect all arguments here, even though they are mostly for start
# This allows detailed status
my( $debug, $verbose, @iso, %iso, $update, $log, $days, $host, $permitonly, @loglimits, @atports, @auports, @aips, @dips );
@loglimits = ( '1/minute', 10 );
while( (my $arg = shift) ) {
    if( $arg =~ /^-/ ) {
        if( $arg eq '-update' ) {
            $update = 1;
            next;
        }
        if( $arg eq '-log' ) {
            $log = 1;
            next;
        }
        if( $arg eq '-limit' && $ARGV[0] ) {
            unless( $ARGV[0] =~ m#(\d+/(?:second|minute|hour|day))(?::(\d+))?# ) {
                print "Syntax error in -limit\n";
                exit 1;
            }
            shift;
            $loglimits[0] = $1;
            $loglimits[1] = $2 if( defined $2 );
            next;
        }
        if( $arg eq '-nolimit' ) {
            @loglimits = ();
            next;
        }
        if( $arg eq '-nolog' ) {
            $log = 0;
            next;
        }
        if( $arg eq '-permitonly' ) {
            $permitonly = 1;
            next;
        }
        if( $arg eq '-d' ) {
            $debug = 1;
            next;
        }
        if( $arg eq '-v' ) {
            $verbose = 1;
            next;
        }
        if( $arg eq '-days' && $ARGV[0] && $ARGV[0] =~ /^\d+$/ ){
            $days = shift;
            next;
        }
        if( $arg eq '-host' && $ARGV[0] ){
            $host = shift;
            next;
        }
        if( $arg eq '-atport' && $ARGV[0] ){
            $arg = shift;
            if( $arg =~  /^(?:\d+)$/ ) {
                push @atports, $arg;
                next;
            }
            my $val = getservbyname( $arg, 'tcp' );
            if( defined $val ) {
                push @atports, $val;
                next;
            }
            print "Invalid port $arg\n";
            exit 1;
        }
        if( $arg eq '-auport' && $ARGV[0] ){
            $arg = shift;
            if( $arg =~  /^(?:\d+)$/ ) {
                push @auports, $arg;
                next;
            }
            my $val = getservbyname( $arg, 'udp' );
            if( defined $val ) {
                push @auports, $val;
                next;
            }
            print "Invalid port $arg\n";
            exit 1;
        }
        if( $arg eq '-aip' && $ARGV[0] ) {
            if( $ARGV[0] =~ /^\d{1,3}(?:\.\d{1,3}){0,3}(?:\/(?:\d+|(?:\d{1,3}(?:\.\d{1,3}){3})))?$/ ){
                push @aips, NetAddr::IP->new( shift );
                next;
            }
            my @h = gethostbyname( $ARGV[0] );
            unless( @h) {
                print "Unknown host $ARGV[0]\n";
                exit 1;
            }
            unless( $h[3] == 4 && $#h >= 4 ) {
                print "$ARGV[0] : not an IPV4 address\n";
                exit 1;
            }
            for my $a (@h[4..$#h]) {
                push @aips, NetAddr::IP->new( sprintf( "%vd", $a ) );
            }
            shift;
            next;
        }
        if( $arg eq '-dip' && $ARGV[0] ) {
            if( $ARGV[0] =~ /^\d{1,3}(?:\.\d{1,3}){0,3}(?:\/(?:\d+|(?:\d{1,3}(?:\.\d{1,3}){3})))?$/ ){
                push @dips, NetAddr::IP->new( shift );
                next;
            }
            my @h = gethostbyname( $ARGV[0] );
            unless( @h) {
                print "Unknown host $ARGV[0]\n";
                exit 1;
            }
            unless( $h[3] == 4 && $#h >= 4 ) {
                print "$ARGV[0] : not an IPV4 address\n";
                exit 1;
            }
            for my $a (@h[4..$#h]) {
                push @dips, NetAddr::IP->new( sprintf( "%vd", $a ) );
            }
            shift;
            next;
        }
        if( $arg eq '-h' || $arg eq '--help' ) {
            Usage();
            exit 0;
        }
        print "Unknown switch $arg";
        print ' ', $ARGV[0] if( defined $ARGV[0] );
        print "\n";
        exit 1;
    }
    if( defined code2country( $arg ) ) {
        $iso{lc $arg} = 1;
    } else {
        my $cc = country2code( $arg );
        if( defined $cc ) {
            $iso{lc $cc} = 1;
        } else {
            print "Unrecognized country/country code: $arg\n";
            exit 1;
        }
    }
}
@iso = sort keys %iso;
@iso = @DEFAULT_ISO unless( @iso );
sub Usage {
    print << "HELP";
IP filter manager for country filters
Usage: $prog command args
  status [-v]        Display filter status
                     -v provides configuration from config file
                     and command file - NOT iptables.
  list               List available country names/codes
                       Contacts server for list.
  intercepts [-host name] [-days n]
                     List today's intercepts by host (from $LOG)
                     Requires -log
  stop               Stop filtering
  restart  args      Synonym for start (reloads with no open window)
  condrestart args   Restarts only if already running
  start args         Starts filter
Start uses tables of IP blocks assigned to country codes that are
stored in $ZONEDIR, which will be created if necessary.  The data
is obtained from $BLOCKURL when needed,
or when start -update is specified.
iptables filters are generated and installed by start.  The filters are
optimized and generally will not look identical to the input data.  However
they will match the same address (no more and no fewer.)
Arguments for start-class commands are:
 -update            Get latest data for active country codes.
                    Otherwise, only gets data if no local file exists for a CC.
 -log               Install a logging rule to log rejected packets.
 -nolog             Don't install a logging rule (default)
 -nolimit           Do not limit logging (can generate huge log files if under attack; not advised)
 -limit spec        Limit logging, default = $loglimits[0]:$loglimits[1] (see man iptables "limit")
 -atport n          Allow connections to TCP port n even from banned addresses.
                    May specify any number of times.  May use a service name.
 -auport n          Allow connections to UDP port n even from banned addresses.
                    May specify any number of times.  May use a service name.
 -aip ip(/mask)     Allow connection from an otherwise banned IP address.
                    For a block, specify a netlength or mask. A hostname may
                    also be specified.
 -dip ip(/mask)     Deny connections from an otherwise allowed IP address.
                    Same syntax as -aip
 -permitonly        Listed countries will be permited, all others denied
 -d                 Output random debugging messages
 -v                 Output extended status/statistics
  CC                ISO Country code or name to ban (as many as you like)
                    Default list:
HELP
    for my $cc (sort @DEFAULT_ISO ) {
        print "                      $cc - ", code2country($cc), "\n";
    }
    print <source/dev/null`);
    # Delete each one
    #  First, delete the rule in the main chain that reads '-s 1st octet, goto subchain'
    #  Then empty and delete the subchain
    for my $schain (@schains) {
        $schain =~ m/-(\d+)$/;
        system( "$IPT -D $chain -s $1.0.0.0/8 -g $schain" );
        system( "$IPT -F $schain" );
        system( "$IPT -X $schain" );
    }
}
sub delchainref {
    my $main = shift;  # e.g. INPUT
    my $chain = shift; # e.g. BLOCKchain
   my @crefs = map { (m/^$chain\s/ ? ( $chain, ) : ()) } split( /\n/, `$IPT -n -L $main 2>/dev/null`);
    for my $cref (@crefs) { # should be only one
        system( "$IPT -D $main -j $cref" );
    }
}
# Sort function for IP addresses for installation into filter chains
# The whole chain must be processed if we miss, so there's nothing we can do.
# But on a hit, we can improve the expected time somewhat by checking the
# largest blocks first.  This corresponds to the smallest mask length.
# It is possible to do better if the traffic pattern is known, but there
# isn't a good way (short of active feedback) to determine it.
# In any case, we reduce the search length by hashing on the first
# octet of the address, so this is a secondary effect.
sub ipcmp {
    my $x = $a->masklen  $b->masklen;
    return $x if( $x );
    return $a  $b;
}
sub start {
    print "Starting blocked countries IP filter: " unless( $ENV{CRONJOB} );
    File::Path::make_path( $ZONEDIR, { mode => 0771 } ) unless( -d $ZONEDIR );
    # Delete any lingering references / parts of new chain
    delchainref( $IHOOK, $IPNEWCHAIN );
    # Perhaps someday if I want to spend core on -d rules
#    delchainref( $OHOOK, $IPNEWCHAIN );
#    delchainref( $FHOOK, $IPNEWCHAIN );
    delsubchains( $IPNEWCHAIN );
    system( "$IPT -F $IPNEWCHAIN >/dev/null 2>&1" );
    system( "$IPT -X $IPNEWCHAIN >/dev/null 2>&1" );
    # (Log & ) drop chain
    system( "$IPT -F $IPNEWCHAIN-DLOG >/dev/null 2>&1" );
    system( "$IPT -X $IPNEWCHAIN-DLOG >/dev/null 2>&1" );
    return failure unless( system( "$IPT -N $IPNEWCHAIN-DLOG" ) == 0 );
    if( $log ) {
        # Note that we can not provide a per-country log prefix due to compaction.
        # However, the intercepts report will map IPs back to their (alleged) country of origin
        # To determine what countries are causing intercepts, the logs must be post-processed to
        # lookup each IP.
        my $limits = "";
        $limits = "-m limit --limit $loglimits[0] --limit-burst $loglimits[1] " if( @loglimits );
        return failure unless( system( "$IPT -A $IPNEWCHAIN-DLOG $limits-j LOG --log-prefix \"$LOGPFX\"" ) == 0 );
    }
    return failure unless( system( "$IPT -A $IPNEWCHAIN-DLOG -j DROP" ) == 0 );
    return failure unless( system( "$IPT -N $IPNEWCHAIN" ) == 0 );
    return failure unless( system( "$IPT -A $IPNEWCHAIN -m state --state RELATED,ESTABLISHED -j RETURN" ) == 0 );
    # List any allowed ports - first since they have a netmask of 0
    # Allowed TCP ports - no more than 15 per rule (limit of multiport)
    my $exceptions = @aips + @auports + @atports;
    my $xrules = 0;
    while( @atports ) {
        my $n = @atports;
        $n = 15 if( $n > 15 );
        return failure unless( system( "$IPT -A $IPNEWCHAIN -p tcp -m multiport --dports " . join( ',', @atports[0..$n-1] ) . ' -j RETURN' ) == 0 );
        splice( @atports, 0, $n );
        $xrules++;
    }
    # Allowed UDP ports
    while( @auports ) {
        my $n = @auports;
        $n = 15 if( $n > 15 );
        return failure unless( system( "$IPT -A $IPNEWCHAIN -p udp -m multiport --dports " . join( ',', @auports[0..$n-1] ) . ' -j RETURN' ) == 0 );
        splice( @auports, 0, $n );
        $xrules++;
    }
    # Allowed IPs (with optional masklen/netmask); largest size first
    #
    # Local subnets - external firewalls prevent them from showing up here, but
    # a bogus zone file could do damage.
    unshift @aips, NetAddr::IP->new( '192.168.0.0/16' ), NetAddr::IP->new( '172.16.0.0/12' ), NetAddr::IP->new( '10.0.0.0/8' );
    $exceptions += 3;
    @aips = sort ipcmp NetAddr::IP::Compact( @aips );
    $xrules += @aips;
    while( @aips ) {
        return failure unless( system( "$IPT -A $IPNEWCHAIN -s " . shift( @aips ) . ' -j RETURN' ) == 0 );
    }
    # Explicitly blocked IPs
    @dips = sort ipcmp NetAddr::IP::Compact( @dips );
    $xrules += @dips;
    while( @dips ) {
        return failure unless( system( "$IPT -A $IPNEWCHAIN -s " . shift( @dips ) . " -j $IPNEWCHAIN-DLOG" ) == 0 );
    }
    if( $verbose ) {
        # Exception statistics
        print( "\n",
               "$exceptions exceptions generated $xrules rules." );
    }
    # Make sure we have a zone file for each country code
    # Fetch a new one if -update or we don't have one
    # If we fetch, only transfer the file if it's different from (usu. newer than) our copy.
    my @files;
    for my $c (@iso) {
        my $db = "$ZONEDIR/$c.zone";
        my $cn = code2country( $c );
        $cn = " ($cn)" if( defined $cn );
        # Fetch if updating or have no data
        if( $update || ! -f $db || -z $db ) {
            my $rc = mirror( "$BLOCKURL/$c.zone", $db );
            if( is_success( $rc ) ) {
                print "\nUpdated IP zone data for $c$cn", if( $debug || $update || $ENV{CRONJOB} );
                # Shouldn't ever get an empty file, but may as well check
                unless( -f $db && -s $db ) {
                    print "\nUpdated zone data for $c$cn is empty!";
                    unlink $db;
                    return failure;
                }
            } else {
                if( $rc == RC_NOT_MODIFIED ) { # Can only happen if file exists
                    print "\nNo new IP data available for $c$cn " if( $debug || ($update && !$ENV{CRONJOB}) );
                } else {
                    print "\nUnable to fetch IP zone data for $c$cn: $rc - ", status_message($rc), " ";
                }
                unless( -f $db && -s $db ) {
                    # No data - don't replace current filter
                    print "\nNo IP zone data available for $c$cn ";
                    if( $debug ) {
                        next;
                    }
                    return failure;
                }
                # Failed, but have old file, continue since other zones may be updated
            }
        }
        push @files, $db;
    }
    return failure unless( @files );
    # Parse the zone files and create a list of IP blocks
    my @addresses = ();
    for my $if (@files) {
        open( my $ifh, '<', $if ) or die( "Can't open $if: $!" );
        while(  ) {
            s/\s*#.*$//;
            next unless( length );
            push @addresses, NetAddr::IP->new( $_ );
        }
        close $ifh;
    }
    return failure unless( @addresses );
    # Compact the blocks into the minimal covering set
    my $inaddrs = @addresses;
    @addresses = sort ipcmp NetAddr::IP::Compact(@addresses);
    # Generate an iptables-restore file with the new rules
    my %subchains;
    open( my $fh, '>', $ZONETBL ) or die( "Can't open $ZONETBL: $!" );
    print $fh "# Generated by $prog on ", (scalar localtime), "\n",
              "*filter\n";           # table
    if( $IHOOK eq 'INPUT' ) {
        print $fh ":INPUT ACCEPT [0:0]\n"; # built-in chain, policy, counters
    }
    # Note: Do not include input hook table declaration as this will clear it
    # It is guaranteed to exist because we checked earlier
    foreach my $ipblock (@addresses) {
        $ipblock =~ /^(\d+)\./;
        unless( $subchains{$1} ) {
            print $fh ":$IPNEWCHAIN-$1 - [0:0]\n",    # subchain, no policy, zero counters
              "-A $IPNEWCHAIN -s $1.0.0.0/8 -g $IPNEWCHAIN-$1\n";  # Chain - branch on 1st octet to subchain
        }
        $subchains{$1}++;
        if( $permitonly ) {
            print $fh "-A $IPNEWCHAIN-$1 -s $ipblock -j RETURN\n"; # Subchain, accept
        } else {
            print $fh "-A $IPNEWCHAIN-$1 -s $ipblock -j $IPNEWCHAIN-DLOG\n"; # Subchain, branch on match to log & drop
        }
    }
    if( $permitonly ) {
        foreach my $subchain (keys %subchains) {
            print $fh "-A $IPNEWCHAIN-$subchain -j $IPNEWCHAIN-DLOG\n";
        }
    }
    print $fh "COMMIT\n",
              "# Completed on ", (scalar localtime), "\n";
    close $fh;
    if( $verbose ) {
        # Provide some statistics, mostly for debugging.
        my( $minlen, $maxlen );
        $minlen = $maxlen = $subchains{(keys %subchains)[0]};
        for my $s (values %subchains) {
            $minlen = $s if( $s  $maxlen );
        }
        print( "\n",
               $inaddrs . ($permitonly? ' permitted' : ' blocked') . " address ranges generated ",
               (scalar @addresses), " rules, using ",
               (scalar keys %subchains), " sub-chains.  Savings: ",
               ($inaddrs - scalar @addresses), " rules (",
               sprintf( "%.2f", 100*(1- ((scalar @addresses))/$inaddrs)), "%).  Minimum chain length: $minlen",
               ", Maximum: $maxlen\n" );
    }
    # Install new ruleset
    # -- Mass-install new Chain, subchains & rules
    return failure unless( system( "$IPTR -n $ZONETBL" ) == 0 );
    # -- Link INPUT to the new chain
    return failure unless( system( "$IPT -I $IHOOK -j $IPNEWCHAIN" ) == 0 );
#    return failure unless( system( "$IPT -I $OHOOK -j $IPNEWCHAIN" ) == 0 );
#    return failure unless( system( "$IPT -I $FHOOK -j $IPNEWCHAIN" ) == 0 );
    # Remove old rules
    delchainref( $IHOOK, $IPOLDCHAIN );
#    delchainref( $OHOOK, $IPOLDCHAIN );
#    delchainref( $FHOOK, $IPOLDCHAIN );
    delsubchains( $IPOLDCHAIN );
    system( "$IPT -F $IPOLDCHAIN >/dev/null 2>&1" );
    system( "$IPT -X $IPOLDCHAIN >/dev/null 2>&1" );
    system( "$IPT -F $IPOLDCHAIN-DLOG >/dev/null 2>&1" );
    system( "$IPT -X $IPOLDCHAIN-DLOG >/dev/null 2>&1" );
    $IPOLDCHAIN = $IPNEWCHAIN;
    return success if( running );
    return failure;
}
sub stop {
    return 1 if( !running );
    print "Removing blocked countries IP filter";
    delchainref( $IHOOK, $IPOLDCHAIN );
    delsubchains( $IPOLDCHAIN );
    system( "$IPT -F $IPOLDCHAIN" );
    system( "$IPT -X $IPOLDCHAIN" );
    system( "$IPT -F $IPOLDCHAIN-DLOG" );
    system( "$IPT -X $IPOLDCHAIN-DLOG" );
    if( !running ) {
        success;
        return 1;
    }
    failure;
    return 0;
}
sub restart {
    # Don't stop since start will keep the current table alive until
    # the new one is active.
    return start();
}
# List intercepted IPs for today
# This can be run in a cron job just before midnight to get a list of
# IPs to report.  Or, you can use -days n to get the last n days worth
# of intercepts
# Only works if logging is on
sub intercepts {
    my( $fh, %ips );
    $days ||= 1;
    my $start = time() - ( $days * 24*60*60 );
    $host ||= Net::Domain::hostname();
    foreach my $logfile (glob $LOG) {
        my $lh = IO::Uncompress::Gunzip->new( $logfile, MultiStream => 1, Transparent => 1 );
        unless( $lh ) {
            print "Skipping system log file: $IO::Uncompress::Gunzip::GunzipError\n";
            next;
        }
        my $sl = Parse::Syslog->new( $lh, arrayref => 1 );
        # Record # intercepts for each ip => protocol => port
        while( my $l = $sl->next ) {
            next if( $l->[0] [2] eq $LOGPGM && $l->[1] =~ /$host/i;
            if( $l->[4] =~ /^\Q$LOGPFX\E.*?\bSRC=([0-9.]+).*?\bPROTO=(ICMP)\b.*?\bTYPE=(\d+)/ ) {
                $ips{$1}{lc $2}{$3}++;
            } elsif( $l->[4] =~ /^\Q$LOGPFX\E.*?\bSRC=([0-9.]+).*?\bPROTO=(\w+).*?\bDPT=(\d+)/ ) {
                $ips{$1}{lc $2}{$3}++;
            }
        }
        close $lh;
    }
    return 0 unless %ips;
    # List each intercepted IP, its country, the protocols, ports and number of packets for each
    print "Intercepts by host IP:\n";
    my( %ccip, %ccn );
    foreach (glob "$ZONEDIR/*.zone") {
        /$ZONEDIR\/(.*).zone/;
        my $cc = $1;
        next unless( defined code2country( $cc ) ); # Skip undocumented zone files
        open( my $ifh, '<', $_ ) or next;
        while(  ) {
            s/\s*#.*$//;
            next unless( length );
            push @{$ccip{$cc}}, NetAddr::IP->new( $_ );
        }
        close $ifh;
    }
    for my $ip (sort map {NetAddr::IP->new($_)} keys %ips) {
        my $ccn;
      CCSEARCH:
        foreach my $cc (keys %ccip) {
            foreach my $cip (@{$ccip{$cc}}) {
                if( $cip->contains($ip) ) {
                    print "$cc: ";
                    $ccn = $cc;
                    last CCSEARCH;
                }
            }
        }
        unless( $ccn ) {  # Possible if we've stopped blocking a country but have old log entries
            $ccn = '??';
            print '??: ';
        }
        print $ip->addr;
        my @plist = sort keys %{$ips{$ip->addr}}; # Protocol
        for my $p (@plist) {
            my @rlist = sort keys %{$ips{$ip->addr}{$p}}; # Ports
            print ' ', join( ' ', map { my $n = $ips{$ip->addr}{$p}{$_}; $ccn{$ccn} += $n; "$p-$_($n)" } @rlist );
        }
        print "\n";
    }
    print "Intercepts by country:\n";
    for my $cc (sort {$ccn{$b}  $ccn{$a} } keys %ccn) {
        my $cn = code2country($cc);
        if( defined $cn ) {
            $cn = "$cc ($cn)";
        } else {
            $cn = $cc;
        }
        printf "%10u %s\n", $ccn{$cc}, $cn;
    }
    return 1;
}
if( $cmd eq 'start' ) {
    exit !start();
}
if( $cmd eq 'stop' ) {
    exit !stop();
}
if( $cmd eq 'restart' ) {
    exit !restart();
}
if( $cmd eq 'condrestart' ) {
    exit !(running && restart());
}
if( $cmd eq 'status' ) {
    exit !status();
}
if( $cmd eq 'list' ) {
    exit !list();
}
if( $cmd eq 'intercepts' ) {
    exit !intercepts();
}
if( $cmd eq 'help' ) {
    Usage();
    exit;
}
print "Usage: $prog (start|stop|restart|condrestart|status|list|intercepts|help)\n";
exit 1;

Reply