Forum Debian Users Gang

table netdev traffic-control {
    set autoban {
        type ipv4_addr
        size 128000
        flags dynamic,timeout
        timeout 1h
    }

    chain INGRESS {
        type filter hook ingress device "bond0" priority 0; policy accept;
        iif != "lo" ip saddr @autoban update @autoban { ip saddr timeout 1d } counter drop
        iif != "lo" tcp dport 22 add @autoban { ip saddr } counter drop
    }
}

# cat /etc/nftables/sets/nft_set-bt_spyware.nft
#!/usr/sbin/nft -f

define bt_spyware = {
    2.60.13.132,
    4.21.117.128-4.21.117.159,
    4.21.149.0-4.21.149.31,
    4.43.44.32-4.43.44.63,
    4.43.44.128-4.43.44.143,
    4.43.119.0-4.43.119.127,
...
    222.189.238.210,
    222.216.28.25,
    222.223.183.30,
    222.237.76.91,
    238.209.5.182,
}

add set ip raw-set bt_spyware { type ipv4_addr; flags interval; auto-merge; elements = $bt_spyware }

# cat /etc/nftables/sets.nft
#!/usr/sbin/nft -f

create table ip raw-set
#delete table ip raw-set

create chain ip raw-set PREROUTING { type filter hook prerouting priority -301; policy accept; }
create chain ip raw-set OUTPUT { type filter hook output priority -301; policy accept; }

create chain ip raw-set peerblock-in
create chain ip raw-set peerblock-out

include "./sets/nft_set-bt_level1.nft"
include "./sets/nft_set-bt_spyware.nft"
include "./sets/nft_set-bt_webexploit.nft"
include "./sets/nft_set-whitelist.nft"

add rule ip raw-set PREROUTING meta iif !="lo" jump peerblock-in
add rule ip raw-set OUTPUT meta oif !="lo" jump peerblock-out

add rule ip raw-set peerblock-in  ip saddr @whitelist counter accept
add rule ip raw-set peerblock-out ip daddr @whitelist counter accept
add rule ip raw-set peerblock-in  ip saddr @bt_webexploit counter drop
add rule ip raw-set peerblock-out ip daddr @bt_webexploit counter drop
add rule ip raw-set peerblock-in  ip saddr @bt_spyware counter drop
add rule ip raw-set peerblock-out ip daddr @bt_spyware counter drop

#add rule ip raw-set peerblock-in  ip saddr @bt_level1 tcp sport vmap { 80:accept, 443:accept } counter drop
#add rule ip raw-set peerblock-in  ip saddr @bt_level1 udp sport vmap { 80:accept, 443:accept } counter drop
#add rule ip raw-set peerblock-out ip daddr @bt_level1 tcp dport vmap { 80:accept, 443:accept } counter drop
#add rule ip raw-set peerblock-out ip daddr @bt_level1 udp dport vmap { 80:accept, 443:accept } counter drop

add rule ip raw-set peerblock-in  ip saddr @bt_level1 tcp sport != { 80, 443 } counter drop
add rule ip raw-set peerblock-in  ip saddr @bt_level1 udp sport != { 80, 443 } counter drop
add rule ip raw-set peerblock-out ip daddr @bt_level1 tcp dport != { 80, 443 } counter drop
add rule ip raw-set peerblock-out ip daddr @bt_level1 udp dport != { 80, 443 } counter drop