67 lines
2.9 KiB
Bash
67 lines
2.9 KiB
Bash
#!/bin/sh
|
|
|
|
# create ipset
|
|
ipset create ustc_blacklist_v4 hash:ip --exist
|
|
ipset create ustc_blacklist_v4_net hash:net --exist
|
|
ipset create ustc_blacklist_v6 hash:ip --exist
|
|
ipset create ustc_blacklist_v6_net hash:net --exist
|
|
# flush ipset
|
|
ipset flush ustc_blacklist_v4
|
|
ipset flush ustc_blacklist_v4_net
|
|
ipset flush ustc_blacklist_v6
|
|
ipset flush ustc_blacklist_v6_net
|
|
|
|
# delete data if exist
|
|
[ -f "blacklist_ustc.txt" ] && rm blacklist_ustc.txt
|
|
wget http://blackip.ustc.edu.cn/list.php?txt -O blacklist_ustc.txt
|
|
|
|
# get wget command status
|
|
if [ $? -eq 0 ]
|
|
then
|
|
echo "Blacklist file downloaded."
|
|
# processing data
|
|
echo "Processing data..."
|
|
python3 proceed.py
|
|
# add the host foreach in file to ipset
|
|
# ipv4
|
|
echo "Processing ipv4 list."
|
|
for addr in `cat dst/ipv4_list.txt`
|
|
do
|
|
ipset add ustc_blacklist_v4 $addr
|
|
done
|
|
echo "finshed."
|
|
# ipv4_net
|
|
echo "Processing ipv4 net list."
|
|
for addr in `cat dst/ipv4_net_list.txt`
|
|
do
|
|
ipset add ustc_blacklist_v4_net $addr
|
|
done
|
|
echo "finshed."
|
|
# ipv6
|
|
echo "Processing ipv6 list."
|
|
for addr in `cat dst/ipv6_list.txt`
|
|
do
|
|
ipset add ustc_blacklist_v6 $addr
|
|
done
|
|
echo "finshed."
|
|
# ipv6 net
|
|
echo "Processing ipv6 net list."
|
|
for addr in `cat dst/ipv6_net_list.txt`
|
|
do
|
|
ipset add ustc_blacklist_v6_net $addr
|
|
done
|
|
echo "finshed."
|
|
else
|
|
echo "Failed to fetch the blacklist file."
|
|
fi
|
|
|
|
# config iptables
|
|
iptables --table filter --append INPUT --match set --match-set ustc_blacklist_v4 src --jump DROP
|
|
iptables --table filter --append INPUT --match set --match-set ustc_blacklist_v4_net src --jump DROP
|
|
iptables --table filter --append INPUT --match set --match-set ustc_blacklist_v6 src --jump DROP
|
|
iptables --table filter --append INPUT --match set --match-set ustc_blacklist_v6_net src --jump DROP
|
|
|
|
# echo
|
|
echo "iptable updated."
|
|
echo "listing options..."
|
|
iptables --table filter --list --line-numbers |