Daemon blocking IP addresses upon country or blacklist, using nftables
- nftables
- python 3.8+
- PyYAML
- systemd (for daemon)
- download publicly available blacklists and block IPs from them
- block or whitelist countries
- whitelist network or IP address
- IP versions supported (IPv4, IPv6)
- blocking policy (reject, drop)
- white list (network or IP addresses)
- blacklist URL
- block output connections to blacklisted IPs
- list of countries
- policy for countries (accept, block)
- ports excluded from country blocks
For example:
yay -S nft-blackhole
paru -S nft-blackhole
pikaur -S nft-blackholegit clone https://github.com/tomasz-c/nft-blackhole.gitnftables- PyYAML:
python3-yaml(Debian/Ubuntu)python3-pyyaml(CentOS/Fedora/AlmaLinux/Rocky Linux)python3-PyYAML(openSUSE)py3-yaml(Alpine Linux)
sudo cp -i nft-blackhole.conf /etc/
sudo cp -i nft-blackhole.py /usr/local/sbin/
sudo mkdir /usr/share/nft-blackhole
sudo cp -i nft-blackhole.template /usr/share/nft-blackhole/
sudo cp -i nft-blackhole.service /lib/systemd/system/
sudo cp -i nft-blackhole-reload.service /lib/systemd/system/
sudo cp -i nft-blackhole-reload.timer /lib/systemd/system/Check for existing installation:
[[ -f /usr/bin/nft-blackhole.py ]] && echo "BEWARE, another version is already installed"/etc/nft-blackhole.conf
/usr/local/sbin/nft-blackhole.py start
/usr/local/sbin/nft-blackhole.py reload
/usr/local/sbin/nft-blackhole.py restart
/usr/local/sbin/nft-blackhole.py stopsystemctl enable nft-blackhole.service
systemctl start nft-blackhole.service
systemctl reload nft-blackhole.service
systemctl restart nft-blackhole.servicenft list chain inet blackhole inputnft list table inet blackholenft-blackhole can download new versions of any blacklist it uses. You can trigger this manually, however it is better to have it automatically and periodically done (either thanks to a cron job or to a Systemd timer).
/usr/local/sbin/nft-blackhole.py reload
systemctl reload nft-blackhole.service0 */6 * * * systemctl reload nft-blackhole.service
systemctl enable --now nft-blackhole-reload.timer
systemctl list-timers --allcountry-ip-blocks - CIDR country-level IP lists
https://iplists.firehol.org/ - aggregated, publicly available blacklists
Code released under MIT license.