[HrDe]

Thread Level : A Class Hacker or Senior

Some times you want to break access of some IP from a country to your website, so how to stop him ?

Somebody told you use application mod_geoip with Apache and also more but this application isn't globally.If you use Apache to block IPs, still many ports are open to blocked country. So here i am going to tell you one another things which works with Linux OS for block IPs.

Here i am tell you about IPSet for make object successful so i am starting with introduction of IPSET...


ipset is used to set up, maintain and inspect so called IP sets in the Linux kernel. Depending on the type of the set, an IP set may store IP(v4/v6) addresses, (TCP/UDP) port numbers, IP and MAC address pairs, IP address and port number pairs, etc. See the set type definitions below.
Iptables matches and targets referring to sets create references, which protect the given sets in the kernel. A set cannot be destroyed while there is a single reference pointing to it.

Feature of IPset:

1. Store Multiple IPs and Ports on the Table and doing matching at the working time.
2. Dynamic Update of IPs and Ports without low performance.

We will need the Source Code for install IPset on the Linux so for it always used Current Kernal. Mostaly the Kernel Source Code is found under /usr/src/linux-<version> which access as
/usr/src/linux-(uname -r) at shell.

There are two version of IPset available ...


For the new branch
linux kernel source code (version >= 2.6.34)
source of ipset: ipset-6.11.tar.bz2 (md5sum)
For the old branch
linux kernel source code (version >= 2.6.16 or >= 2.4.36)
source of ipset: ipset-4.5.tar.bz2 (md5sum)


For Download Click Here


Installation Of IPset:

Open your Linux Terminal and follow the steps.

First Extract the ipset, here i am try ipset-4.5.tar.gz ....

Code:

>tar -xf ipset-4.5.tar.gz

Now going for change the directory to ipset-4.5....

Code:

>cd ipset-4.5

Here i am consider the kernel source code available at /usr/src/linux-(uname -r) ,so i am going to compile ipset:

Code:

>make KERNEL_DIR=/usr/src/$(uname -r) IP_NF_SET_MAX=256 IP_NF_SET_HASHSIZE=1024

Here IP_NF_SET_MAX controls the maximum number of IPSets and IP_NF_SET_HASHSIZE set the default size for hash maps.

Now , i am going to install the IPset ,i thing you would know about "sudo" or "su -c" ,lets run command...

Code:

>sudo make install

or

Code:

>su -c 'make install'

After installation you will be ready for Block IPs.


Creating IPsets and Add IPs :

See below command :

Code:

# ipset -N countries nethash

First thing is here, above write command execute as root ,and this creates a ipset which name is 'country' of type 'nethash' , i am explain it step wise step see....

'Countries' each set can be found in ipset and start adding IP address to set.
'nethash' is a set type, if you want know more then going to here http://ipdeny.com/

We had created set named "countries" , now start adding IPs address to the set ,if i want blocking china IPs so add IPs of this zone from here http://www.ipdeny.com/ipblocks/data/countries/cn.zone

Here i am use simple for-loop for get to retrieve zone files:

Code:

# for IP in $ (wget -0 - http://www.ipdeny.com/ipblocks/data/countries/cn.zone) > do > ipset -A countries $IP >done

Now all the IPs are add in countries set if you want to add new IPs so i am tell you a nethash store up to 65535 address,if you want add more then make new set for these.


I think my this post very helpful for a website admin if you want know some more command and information then click below link:

http://ipset.netfilter.org/ipset.man.html

http://www.ipdeny.com/ipblocks/data/countries/ (Sets of Country IP Zone)

http://ipset.netfilter.org/iptables.man.html


Please given comment and tell me you like or not my this post.







http://www.hackarde.com/2012/03/block-ip...acker.html

[HrDe]

I have totally wonder ,here 50 view but no any reply......wht all bro ,i think no any use of this post so request to admin plz remove it.

[Hippo]

Looking g8t but i have not any knowledge so never going to try HQ post g8t

[Dead_Punisher]

Hmm I'm on Windows.So N'thing To say

[HrDe]

Thanks to Hippo and Dead_Punisher bro for coming and like this thread, u hv no knowledge about LINUX so did not matter.Try in future!!!!!!

[HrDe]

Looking g8t but i have not any knowledge so never going to try HQ post g8t

Thanks bro for like my work done.