linblock.pl - Automatically download antip2p blacklist and install into Linux's IPTables interface
./linblock.pl [ -c chain ] [ -u url | -i file ] [ -p prefix ] [ -l ] [ -r ] [ -f ] [ -q ] [ --help ] [ --version ]
linblock.pl downloads a list of IP address ranges in the ``PeerGuardian'' format, and installs them into the Linux kernel using the IPTables interface. This effectively blocks access to the machine from any address listed in the blacklist file. When run it first clears the chain created by previous execution of the command, so it is suitable to be scheduled for automatic updates by 'cron' or similar.
All command line options are optional.
http://www.bluetack.co.uk/config/antip2p.txt.
The URL should point to a text file that contains IP ranges in the ``PeerGuardian'' format.
linblock.pl -f the
IPTables configuration will return to the state it was in before any invocation of the script. Note:
If you specify a non-default chain name when installing the rules you must specify it when flushing them
as well.
/var/log/syslog or /var/log/messages file.
antip2p. The chain's name
has no effect on its functionality, other than the fact that it must be unique.
perldoc -F linblock.pl.
Note: You must be root for all of the module installation procedures in this section.
After downloading the script, make sure it has the ``x'' bits set: 'chmod 755 linblock.pl' or equivalent.
This script requires the Perl modules Net::IP, IPTables::IPv4, and LWP::Simple. You must install them from CPAN if they are not installed on your system already. To check if a module is installed, use the following command:
If the Net::IP module is not installed on your system you will get an error message, otherwise the command will silently complete.
To install a module from CPAN, use the following command:
This will launch CPAN and attempt to install the Net::IP module. If this is the first time that you have used CPAN, it will
ask you a number of questions. You can simply press return to accept the default for most of them. The only questions that require
interaction are selecting your continent and selecting a mirror site to download from. Repeat the above command for the rest
of the modules you lack. Note: To install LWP::Simple use 'install LWP'.
If you have the 'cpan' command installed on your system you can try the following to install all the modules at once:
If you have problems with CPAN not being able to retrieve things, and your firewall uses NAT or IP masquerading, then try setting the FTP_PASSIVE environment variable before running CPAN:
If you find that this causes CPAN to work then you should either add that statement to your startup scripts, or select only http mirrors
to avoid the issue. You can re-do the initial mirror selection process by running 'o conf init' from the CPAN shell, which you can run
by supplying '-e shell' on the command line in place of '-e install ...'.
If some tests fail then CPAN will not install the module by default. Usually you can force the install and get a working module.
To instruct CPAN to ignore failing tests, use 'force install ...' instead of 'install ...' in the command line. For more information
about how to use CPAN, try 'perldoc CPAN.pm'.
Finally, if you cannot make CPAN work at all, you can install the modules by hand, as follows:
Repeat this procedure for the rest of the required modules.
linblock.pl was designed to run automatically for frequent updates. The easiest way to accomplish this is with the 'cron' utility
found on most Linux systems. The script requires root privileges to modify the IPTables rules, thus it should be run from root's crontab.
Log in as root (or type 'su' and supply the root password) and then type 'crontab -e'. This will bring up the crontab file in
an editor. If you have not previously installed anything in this crontab, it will probably be blank.
To run the update once a day at midnight, add a line similar to the following:
0 0 * * * /usr/local/sbin/linblock.pl -q
The first five words on the line control when the job is run. In this case it means that it should be run on the 0th minute of the 0th hour of every day of every month -- i.e. daily at midnight. The command then follows on the rest of the line. You should replace the path in the example with the path where you've placed the script on your local machine, and supply the command-line parameters that you have chosen. -q is suggested, which will suppress the normal program output, instead only warnings and errors will be printed. 'cron' expects that all is successfull if there is no output, and will send you an email if there was any output.
Save the file and exit the editor, and you should see crontab report that it has installed the crontab file.
Copyright (C) 2004 Brian Dessent <brian AT dessent DOT net>
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.