Давно решил эту проблему с помощью ipset, воспользовавшись статьей
https://itsecforu.ru/2018/01/19/скрипт- ... -iptables/
Так же можно скачать скрипт с
https://github.com/trick77/ipset-blacklist. Там же есть ссылка на постоянно обновляющиеся черные списки с различных сервисов
https://github.com/firehol/blocklist-ipsets
Мой ipset-blacklist.conf
Код: Выделить всё
IPSET_BLACKLIST_NAME=blacklist # change it if it collides with a pre-existing ipset list
IPSET_TMP_BLACKLIST_NAME=${IPSET_BLACKLIST_NAME}-tmp
# ensure the directory for IP_BLACKLIST/IP_BLACKLIST_RESTORE exists (it won't be created automatically)
IP_BLACKLIST_RESTORE=/etc/ipset-blacklist/ip-blacklist.restore
IP_BLACKLIST=/etc/ipset-blacklist/ip-blacklist.list
VERBOSE=yes # probably set to "no" for cron jobs, default to yes
FORCE=yes # will create the ipset-iptable binding if it does not already exist
let IPTABLES_IPSET_RULE_NUMBER=1 # if FORCE is yes, the number at which place insert the ipset-match rule (default to 1)
# Sample (!) list of URLs for IP blacklists. Currently, only IPv4 is supported in this script, everything else will be filtered.
BLACKLISTS=(
"file:///etc/ipset-blacklist/ip-blacklist-custom.list" # optional, for your personal nemeses (no typo, plural)
#"file:///etc/ipset-blacklist/ip-blacklist-bots.list"
# "file:///etc/ipset-blacklist/redireckt_atack.txt"
"https://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1" # Project Honey Pot Directory of Dictionary Attacker IPs
"https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1" # TOR Exit Nodes
"https://www.maxmind.com/en/high-risk-ip-sample-list" # MaxMind GeoIP Anonymous Proxies
"http://danger.rulez.sk/projects/bruteforceblocker/blist.php" # BruteForceBlocker IP List
"https://www.spamhaus.org/drop/drop.lasso" # Spamhaus Don't Route Or Peer List (DROP)
"http://cinsscore.com/list/ci-badguys.txt" # C.I. Army Malicious IP List
"https://lists.blocklist.de/lists/all.txt" # blocklist.de attackers
"http://blocklist.greensnow.co/greensnow.txt" # GreenSnow
"http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt"
"https://www.badips.com/get/list/any/0?age=1d"
"https://www.badips.com/get/list/any/1?age=7d"
"https://www.badips.com/get/list/any/2?age=1d"
"https://www.badips.com/get/list/any/2?age=30d"
"https://www.badips.com/get/list/any/2?age=7d"
"http://lists.blocklist.de/lists/all.txt"
"https://blocklist.net.ua/blocklist.csv"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_1d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_30d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_7d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_new.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_new_1d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_new_30d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_new_7d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_top20.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_updated.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_updated_1d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_updated_30d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/cleantalk_updated_7d.ipset"
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset" # Firehol Level 1
"https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/stopforumspam_7d.ipset" # Stopforumspam via Firehol
"https://myip.ms/files/blacklist/csf/latest_blacklist.txt"
"https://myip.ms/files/blacklist/csf/latest_blacklist_users_submitted.txt"
# "http://ipverse.net/ipblocks/data/countries/xx.zone" # Ban an entire country, see http://ipverse.net/ipblocks/data/countries/
)
MAXELEM=16777216
Мой ip-blacklist-bots.list - заношу IP зловредных ботов
Код: Выделить всё
94.100.176.0/20
94.100.181.128/25
195.239.211.0/24
Мой ip-blacklist-custom.list - здесь IP отсутствующие в черных списках, вношу вручную. Можно не использовать если найдутся нужные черные списки.
https://yadi.sk/d/ZvFbmxd4uiCCdA
Мой redireckt_atack.txt - здесь IP с которых идет спамм-атака редиректами. Пополняется вручную из логов.
https://yadi.sk/d/5I-OpD7WF5i1yg
ПС. Уже предлагал встроить такую защиту в ПУ, но пока это не реализовано.
