Skip to content

Instantly share code, notes, and snippets.

@lesstif
Last active September 2, 2020 23:21
Show Gist options
  • Save lesstif/48c1e31ce6a135b2321f8bb4278f570f to your computer and use it in GitHub Desktop.
Save lesstif/48c1e31ce6a135b2321f8bb4278f570f to your computer and use it in GitHub Desktop.
fail2ban 으로 jail 된 IP 를 firewall 에서 차단하기 위한 script
#!/bin/bash
function usage {
echo "USAGE: $0 -z ZONE -i BLOCK-IP1,BLOCK-IP2"
echo ""
echo "$0 -z dmz -i block-ip1,block-ip2"
echo "$0 -z dmz -f block-ip-file"
exit 1
}
if [ "$#" -lt 1 ]; then
usage;
fi
if [ "$EUID" -ne 0 ];then
echo "Please run as root"
exit
fi
PARAM="f:i:z:h";
ZONE=dmz
while getopts $PARAM opt; do
case $opt in
f)
while IFS='' read -r line || [[ -n "$line" ]]; do
# echo "Block IP: $line"
## 맨 앞에 , 가 붙는 걸 방지하기 위해 IPS 변수의 length 확인
if [ -z "$IPS" ];then
IPS="$line";
else
IPS="$IPS,$line";
fi
done < "$OPTARG"
;;
i)
IPS=$OPTARG;
;;
z)
ZONE=$OPTARG;
;;
*)
usage;
;;
esac
done
#echo "To be blocked IPS=$IPS"
IFS=','
for ip in $IPS; do
CMD="firewall-cmd --zone=${ZONE} --add-rich-rule='rule family=\"ipv4\" source address=\"${ip}\" drop'"
echo "${CMD} --permanent" | bash -x
echo ""
RELOAD="firewall-cmd --reload"
echo "${RELOAD}" | bash -x
done
echo "if you want to remove rich-rule run this"
echo "firewall-cmd --permanent --zone=${ZONE} --add-rich-rule='rule family=\"ipv4\" source address=\"remove-ip-here\" drop'"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment