IPアドレスを列挙して一括でdropする君作った

こういうのがlogwatchで発見したので対処。

![スクリーンショット 2014-08-27 8.15.39.png](https://qiita-image-store.s3.amazonaws.com/0/25728/94c9de74-f4a7-8cde-dcb0-4e092f12518e.png)

[以前fail2banを入れた](http://qiita.com/tukiyo3/items/fc69e84ac2b9aae7d16c)が、(それが原因かわからないが)ハングアップしたのでやめた。

iptablesについては[コピペから脱出！iptablesの仕組みを理解して環境に合わせた設定をしよう | OXY NOTES](http://oxynotes.com/?p=6361)が詳しい。

# update_iptables.sh

[download](https://github.com/tukiyo/iptables_filter_list.sh)
Ansibleと組み合わせて(ﾟдﾟ)ｳﾏｰ

```bash:update_iptables.sh
#!/bin/sh
set -eu

DROPLIST="droplist.txt"

head() {
  echo "*mangle"
  echo ":PREROUTING ACCEPT"
  echo ":INPUT ACCEPT"
  echo ":FORWARD ACCEPT"
  echo ":OUTPUT ACCEPT"
  echo ":POSTROUTING ACCEPT"
  echo "COMMIT"
  echo ""
  echo "*nat"
  echo ":PREROUTING ACCEPT"
  echo ":POSTROUTING ACCEPT"
  echo ":OUTPUT ACCEPT"
  echo "COMMIT"
  echo ""
  echo "*filter"
  echo ":INPUT ACCEPT"
  echo ":FORWARD ACCEPT"
  echo ":OUTPUT ACCEPT"
}
body() {
  cat ${DROPLIST} | while read line
  do
    STRCHECK=$(echo ${line} | cut -c 1)
    if [ $STRCHECK != "#" ];then
      echo "-A INPUT -s ${line} -j DROP"
    fi
  done
}
foot() {
  echo "-A INPUT -j ACCEPT"
  echo "COMMIT"
}


head > rule
body >> rule
foot >> rule

for target in mangle nat filter
do
  iptables -F -t $target
done

iptables-restore < rule

for target in mangle nat filter
do
  echo
  echo "## $target"
  iptables -nL -t $target
done
```

# 実行

```bash:
sudo sh update_iptables.sh
```

次回起動時にも適用するには /etc/rc.local で update_iptables.sh を実行させればよい


# 仕様

`update_iptables.sh`を実行すると`droplist.txt`を一行づつ読み込みdrop指定。

* droplist.txtは以下の様な書式

```bash:droplist.txt
# なりすましメール送信者
23.239.20.57
198.58.96.176
72.14.182.114
173.230.157.247
# LOGIN FAILED
202.70.136.74
190.241.183.123
# メール認証に失敗
111.73.45.149
118.193.155.18
12.133.41.130
177.19.151.139
50.57.66.229
61.136.153.176
79.59.139.45
91.98.108.45
```

* iptables-restoreに渡す内容は以下のようになる。

```bash:rule
*mangle
:PREROUTING ACCEPT
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
COMMIT

*nat
:PREROUTING ACCEPT
:POSTROUTING ACCEPT
:OUTPUT ACCEPT
COMMIT

*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
-A INPUT -s 23.239.20.57 -j DROP
-A INPUT -s 198.58.96.176 -j DROP
-A INPUT -s 72.14.182.114 -j DROP
-A INPUT -s 173.230.157.247 -j DROP
-A INPUT -s 202.70.136.74 -j DROP
-A INPUT -s 190.241.183.123 -j DROP
-A INPUT -s 111.73.45.149 -j DROP
-A INPUT -s 118.193.155.18 -j DROP
-A INPUT -s 12.133.41.130 -j DROP
-A INPUT -s 177.19.151.139 -j DROP
-A INPUT -s 50.57.66.229 -j DROP
-A INPUT -s 61.136.153.176 -j DROP
-A INPUT -s 79.59.139.45 -j DROP
-A INPUT -s 91.98.108.45 -j DROP
-A INPUT -j ACCEPT
COMMIT
```

```bash:iptablesの結果
## mangle
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

## nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

## filter
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       0    --  23.239.20.57         0.0.0.0/0
DROP       0    --  198.58.96.176        0.0.0.0/0
DROP       0    --  72.14.182.114        0.0.0.0/0
DROP       0    --  173.230.157.247      0.0.0.0/0
DROP       0    --  202.70.136.74        0.0.0.0/0
DROP       0    --  190.241.183.123      0.0.0.0/0
DROP       0    --  111.73.45.149        0.0.0.0/0
DROP       0    --  118.193.155.18       0.0.0.0/0
DROP       0    --  12.133.41.130        0.0.0.0/0
DROP       0    --  177.19.151.139       0.0.0.0/0
DROP       0    --  50.57.66.229         0.0.0.0/0
DROP       0    --  61.136.153.176       0.0.0.0/0
DROP       0    --  79.59.139.45         0.0.0.0/0
DROP       0    --  91.98.108.45         0.0.0.0/0
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
```