iptables Blocklist Importer

iptables Blocklist Importer is a handy Python program that helps you quickly take P2P-style IP range block lists and import them into your iptables chain. It's super efficient!

Setting Up Your Firewall

First off, you'll want to create an empty chain in your iptables firewall called BadRanges. If you like, you can tweak the code to use a different name! Just make sure to add a reference in your INPUT and/or FORWARD chains. If you're using this on a single computer that isn't acting like a router, you won't need an entry in FORWARD. Here's what I'm using:

iptables -N BadRanges

    iptables -I INPUT -i eth0 -m state --state NEW,RELATED -j BadRanges

    iptables -I FORWARD -i eth0 -m state --state NEW,RELATED -j BadRanges

The commands above assume your external network adapter is named eth0. This setup checks all new incoming connections or packets related to existing ones against the BadRanges list. Don't worry; it won't filter outbound packets, so you can still access websites hosted by IP ranges you don't want connecting back.

Saving Your Settings

Now that we have our entries set up, make sure to save your iptables settings. You can do this by running: iptables-save > /etc/sysconfig/iptables, especially if you're on Fedora. After saving it like this, nothing about how your firewall behaves will change right away.

Using the Python Script

Your next step is to copy iptables-blocklist.py into /usr/local/libexec. This script will parse the list into an iptables-restore format. Also, install zzz-badrangeupdate in either your /etc/cron.daily or /etc/cron.weekly. This will help keep everything updated regularly.

Your Cron Script Explained

The cron script downloads a zipped list of blocked IP ranges if there have been changes since the last run using wget. Once downloaded, it unzips the list and compares it with the previous version just for reference to see what's changed. The unzipped text list of IP ranges is then processed by the iptables-blocklist.py. It turns these into subnets (some ranges may not fit perfectly). The final sorted list is outputted in iptables-restore format and replaces the old BadRanges chain with a new one instantly!