After reading this article:
http://www.theregister.co.uk/2005/08/31/blocking_chinese_ip_addresses/
I got to thinking that there is really no reason for *any* traffic to hit my servers that comes from anywhere outside North America. So I wrote the perl script at the end of this posting to extract selected IP ranges posted at iana.org and convert them into iptables rules blocking any traffic from those ranges.
I'd like comments on this. I know it's not perfect as there are both corporate and 'various registries' address ranges that aren't covered but it's a start. Since my company web site is hosted elsewhere but we are doing the DNS, I put in the exceptions for DNS.
In my ten or so years of administering Linux servers, following the usual security precautions has been sufficient: closing unused ports, keeping up to date on patches, limiting permissions and logins, etc. I've never had a system broken into.
But if I can lessen the bandwidth used up by brute-force password attacks and port scans at the cost of a few CPU cycles, that's a good thing. I've had the new rules up on one server for about half an hour and can see about 10 or so connection attempts from the addresses in question.
What do you think?
Kirk Bocek
#!/usr/bin/perl # # iana-makeiptables.pl # Convert IPv4 Address assignment document from iana.org into # a shell script that will insert iptables rules to block traffic # from selected regional registries. # # Copy the data from: # http://www.iana.org/assignments/ipv4-address-space # and save it to the file in $datafile (here -- iana-assignments.dat) # Then edit the 'my @block' line below to select the registries you want to block # # Sept 6, 2005 Kirk Bocek # use strict;
my $datafile='iana-assignments.dat'; my $outfile='iana-block.sh'; #Registries are ARIN APNIC RIPE LACNIC AfriNIC my @block=qw/APNIC RIPE LACNIC AfriNIC/;
die "Data File $datafile Not Found!" unless -f $datafile; die "Cannot open $outfile for writing!" unless open OUT, ">$outfile"; die "Cannot open $datafile for reading!" unless open DAT, "<$datafile";
print OUT "#!/bin/bash\n"; print OUT "# Blocking traffic from: @block\n"; print OUT "# Generated by iana-makeiptables.pl\n";
foreach (<DAT>) { next unless /^\d{3}/8/; BLOCK: foreach my $reg (@block) { if (/^(\d{3})/8.*$reg/) { my $x=$1; $x=substr($x,1) if substr($x,0,1) eq '0'; #Strip leading zero $x=substr($x,1) if substr($x,0,1) eq '0'; #Might be two of them print OUT 'iptables -I INPUT -s ',$x,".0.0.0/8 -j DROP\n"; last BLOCK; } } }
#Put any exceptions here #For example, I'm allowing DNS traffic print OUT "iptables -I INPUT -p tcp -m tcp --dport 53 -j ACCEPT\n"; print OUT "iptables -I INPUT -p udp -m udp --dport 53 -j ACCEPT\n";
close OUT; close DAT; # End of iana-makeiptables.pl