标签:ane geo 开发 count make www drop lld --
准备xtables-addons-3.0--------------------2018年02月版本
https://newcontinuum.dl.sourceforge.net/project/xtables-addons/Xtables-addons/xtables-addons-3.0.tar.xz
环境检查是否满足需求,具体查看以下链接
https://sourceforge.net/p/xtables-addons/xtables-addons/ci/master/tree/INSTALL
Use xtables-addons-1.x if you need support for Linux < 3.7.
Use xtables-addons-2.x if you need support for Linux < 4.15.
如果要升级内核,参考以下
https://www.vultr.com/docs/how-to-deploy-google-bbr-on-centos-7
内核升级完成后,安装内核开发包(centos, fedora内核不用升级)
安装组件
yum install gcc-c++ make automake wget unzip iptables-devel perl-Text-CSV_XS -y
卸载旧版冲突组件
yum remove kernel-{devel,tools,tools-libs} -y
安装新版
yum --enablerepo=elrepo-kernel install kernel-ml-{devel,tools,tools-libs} -y
创建编译目录
mkdir -p /home/xtables
cd /home/xtables
tar xf xtables-addons-3.0.tar.xz
cd cd xtables-addons-3.0
./configure
make
make install
安装GeoIP Database
cd geoip
./xt_geoip_dl
./xt_geoip_build GeoIPCountryWhois.csv
mkdir -p /usr/share/xt_geoip/
cp -r {BE,LE} /usr/share/xt_geoip/
使用iptables
iptables -m geoip --src-cc country[,country...] --dst-cc country[,country...]
Example:
block incoming traffic from India (IN) and United States (US)
iptables -I INPUT -m geoip --src-cc IN,US -j DROP
block all incoming non-US traffic on our server
iptables -I INPUT -m geoip ! --src-cc US -j DROP
block outgoing traffic destined to India (IN)
iptables -A OUTPUT -m geoip --dst-cc IN -j DROP
使用firewalld
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -m geoip --src-cc IN,UN -j DROP
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -m geoip ! --src-cc US -j DROP
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc IN -j DROP
Enjoy :-)
special for vps using firewalld
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 80 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 443 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -j DROP
firewall-cmd --direct --permanent --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 80 -j ACCEPT
firewall-cmd --direct --permanent --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -p tcp --sport 443 -j ACCEPT
firewall-cmd --direct --permanent --add-rule ipv4 filter OUTPUT 0 -m geoip --dst-cc CN -j DROP
标签:ane geo 开发 count make www drop lld --
原文地址:https://www.cnblogs.com/ticonci/p/12455790.html