Use ipset for blacklists and whitelists

iptables/README.md

@@ -1,18 +1,23 @@
-# Iptables
+# iptables & ipset
 
 ```sh
-sudo cp default.rules empty.rules /etc
+sudo apt install ipset
-sudo cp *.service /etc/systemd/system
-sudo systemctl enable iptables
-sudo systemctl start iptables
 ```
 
-## Apply and Report Rate Limits
+```sh
+sudo cp empty.rules /etc
+sudo touch /etc/{default,ipset}.rules
+sudo cp *.service /etc/systemd/system
+sudo systemctl enable iptables ipset
+sudo systemctl start iptables ipset
+```
 
-The `ratelimit.rules` file adds new chains to
+## Presets
-limit the rate of new connections based on /16 subnets.
 
 ```sh
+sudo ipset restore -f ipset.rules
+sudo iptables-restore -n connection.rules
+sudo iptables-restore -n service.rules
 sudo iptables-restore -n blackwhite.rules
 sudo iptables-restore -n knock.rules
 sudo iptables-restore -n ratelimit.rules

iptables/blackwhite.rules

@@ -2,15 +2,12 @@
 :BLACKLIST -
 :WHITELIST -
 
--A PREROUTING -j BLACKLIST
 -A PREROUTING -j WHITELIST
+-A PREROUTING -j BLACKLIST
 
--A BLACKLIST -s 46.229.160.0/20 -m comment --comment SEMrushBot -j DROP
+-A BLACKLIST -m set --match-set blacklist src -j DROP
--A BLACKLIST -s 114.119.160.0/21 -m comment --comment AspiegelBot -j DROP
 
--A WHITELIST -s 127.0.0.0/8 -m comment --comment localhost -j ACCEPT
+-A WHITELIST -m set --match-set local src -j ACCEPT
--A WHITELIST -s 10.0.0.0/8 -m comment --comment "RFC 1918" -j ACCEPT
+-A WHITELIST -m set --match-set whitelist src -j ACCEPT
--A WHITELIST -s 172.16.0.0/12 -m comment --comment "RFC 1918" -j ACCEPT
--A WHITELIST -s 192.168.0.0/16 -m comment --comment "RFC 1918" -j ACCEPT
 
 COMMIT

iptables/connection.rules

@@ -0,0 +1,6 @@
+*filter
+:CONNECTION -
+-A INPUT -j CONNECTION
+-A CONNECTION -i lo -j ACCEPT
+-A CONNECTION -m state --state RELATED,ESTABLISHED -j ACCEPT
+COMMIT

iptables/ipset.rules

@@ -0,0 +1,8 @@
+create local hash:net
+create whitelist hash:net
+create blacklist hash:net
+
+add local 127.0.0.0/8
+add local 10.0.0.0/8
+add local 172.16.0.0/12
+add local 192.168.0.0/16

iptables/ipset.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=ipset
+Before=network-pre.target iptables.service
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=ipset restore -f /etc/ipset.rules
+ExecStop=ipset save -f /etc/ipset.rules ; ipset destroy
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

iptables/service.rules

@@ -1,15 +1,11 @@
 *filter
 :INPUT DROP
-:CONNECTION -
 :SERVICE -
--A INPUT -j CONNECTION
 -A INPUT -j SERVICE
--A CONNECTION -i lo -j ACCEPT
+-A SERVICE -p tcp --dport 22 -j ACCEPT
--A CONNECTION -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A SERVICE -p tcp --dport 25 -j ACCEPT
 -A SERVICE -p tcp --dport 80 -j ACCEPT
 -A SERVICE -p tcp --dport 143 -j ACCEPT
 -A SERVICE -p tcp --dport 443 -j ACCEPT
--A SERVICE -p tcp --dport 22222 -j ACCEPT
 -A SERVICE -p udp --dport 53 -j ACCEPT
 COMMIT