Shell batch imports domestic ip segments to prevent foreign ip addresses from accessing the server

The customer does not want to allow foreign ip addresses to access the server. The data center was supposed to be routed at the upper end of the server room, but those people did not miss you !!!~~~~ In this case, you can only use iptables to solve the problem ~~~~~~~~~ You can download the ip address library at http://www.ipdeny.com/ipblocks ~~~ # Download the ip library # wgethttp: // rfyia

The customer does not want to allow foreign ip addresses to access the server. The data center was supposed to be routed at the upper end of the server room, but those people did not miss you !!!~~~~

In this case, you can only use iptables to solve the problem ~~~~~~~~~

On the ip library you can go to the http://www.ipdeny.com/ipblocks/ download, there are various countries here ~~~

# Download the ip address library # wget http://rfyiamcool.googlecode.com/files/allip.txtwget http://www.ipdeny.com/ipblocks/data/countries/cn.zone?the Number of dropped sed-I's/; $ // 'allip.txt # the ip address is called for I in 'cat cn. zone 'doecho "iptables-a input-s $ I-j ACCEPT"> iptables. shdonecat iptables. sh

Optimize the script and add the following command before iptables. sh!

#!/bin/bashziji="222.173.13.5"iptables -Fiptables -Xiptables -Ziptables -t nat -F iptables -t mangle -F modprobe iptable_natmodprobe ip_nat_ftpmodprobe ip_nat_ircmodprobe ip_conntrackmodprobe ip_conntrack_ftpmodprobe ip_conntrack_ircmodprobe ipt_limitmodprobe ipt_recent ip_list_tot=16384modprobe ip_conntrack hashsize=16384echo "1024  63000" > /proc/sys/net/ipv4/ip_local_port_rangeecho "1" > /proc/sys/net/ipv4/tcp_tw_recycleecho "1" > /proc/sys/net/ipv4/tcp_tw_reuseecho "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcastsecho "1" >/proc/sys/net/ipv4/conf/all/log_martiansecho "1" >/proc/sys/net/ipv4/tcp_syncookiesecho "2" >/proc/sys/net/ipv4/tcp_synack_retriesecho "5000" >/proc/sys/net/ipv4/tcp_max_syn_backlogecho "3" >/proc/sys/net/ipv4/tcp_syn_retriesecho "1" > /proc/sys/net/ipv4/tcp_tw_reuseecho "1" > /proc/sys/net/ipv4/tcp_tw_recycleecho "30" > /proc/sys/net/ipv4/tcp_fin_timeoutecho "1800" > /proc/sys/net/ipv4/tcp_keepalive_timeecho "1" > /proc/sys/net/ipv4/ip_forwardiptables -P INPUT DROPiptables -P FORWARD ACCEPTiptables -P OUTPUT ACCEPT/sbin/iptables -t nat -P PREROUTING ACCEPT/sbin/iptables -t nat -P POSTROUTING ACCEPTiptables -A INPUT -s $ziji -j ACCEPTiptables -A INPUT -i lo -j ACCEPTiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

Below is~~~~~~~~~~~~~~~~(I shut down the host just now, so we cannot ping O in China ~)