[CentOS] Paranoid Firewalling

After reading this article:

http://www.theregister.co.uk/2005/08/31/blocking_chinese_ip_addresses/

I got to thinking that there is really no reason for *any* traffic to 
hit my servers that comes from anywhere outside North America. So I 
wrote the perl script at the end of this posting to extract selected IP 
ranges posted at iana.org and convert them into iptables rules blocking 
any traffic from those ranges.

I'd like comments on this. I know it's not perfect as there are both 
corporate and 'various registries' address ranges that aren't covered 
but it's a start. Since my company web site is hosted elsewhere but we 
are doing the DNS, I put in the exceptions for DNS.

In my ten or so years of administering Linux servers, following the 
usual security precautions has been sufficient: closing unused ports, 
keeping up to date on patches, limiting permissions and logins, etc. 
I've never had a system broken into.

But if I can lessen the bandwidth used up by brute-force password 
attacks and port scans at the cost of a few CPU cycles, that's a good 
thing. I've had the new rules up on one server for about half an hour 
and can see about 10 or so connection attempts from the addresses in 
question.

What do you think?

Kirk Bocek


#!/usr/bin/perl
#
# iana-makeiptables.pl
# Convert IPv4 Address assignment document from iana.org into
# a shell script that will insert iptables rules to block traffic
# from selected regional registries.
#
# Copy the data from:
#       http://www.iana.org/assignments/ipv4-address-space
# and save it to the file in $datafile (here -- iana-assignments.dat)
# Then edit the 'my @block' line below to select the registries you want 
to block
#
# Sept 6, 2005 Kirk Bocek
#
use strict;

my $datafile='iana-assignments.dat';
my $outfile='iana-block.sh';
#Registries are ARIN APNIC RIPE LACNIC AfriNIC
my @block=qw/APNIC RIPE LACNIC AfriNIC/;

die "Data File $datafile Not Found!" unless -f $datafile;
die "Cannot open $outfile for writing!" unless
         open OUT, ">$outfile";
die "Cannot open $datafile for reading!" unless
         open DAT, "<$datafile";

print OUT "#!/bin/bash\n";
print OUT "# Blocking traffic from: @block\n";
print OUT "# Generated by iana-makeiptables.pl\n";

foreach (<DAT>) {
         next unless /^\d{3}\/8/;
         BLOCK: foreach my $reg (@block) {
                 if (/^(\d{3})\/8.*$reg/) {
                         my $x=$1;
                         $x=substr($x,1) if substr($x,0,1) eq '0'; 
#Strip leading zero
                         $x=substr($x,1) if substr($x,0,1) eq '0'; 
#Might be two of them
                         print OUT 'iptables -I INPUT -s ',$x,".0.0.0/8 
-j DROP\n";
                         last BLOCK;
                 }
         }
}

#Put any exceptions here
#For example, I'm allowing DNS traffic
print OUT "iptables -I INPUT -p tcp -m tcp --dport 53 -j ACCEPT\n";
print OUT "iptables -I INPUT -p udp -m udp --dport 53 -j ACCEPT\n";


close OUT;
close DAT;
# End of iana-makeiptables.pl