Centos6下iptables配置Xtables-Addons和GeoIP屏蔽某个国家ip

 下面来为各位介绍一个Centos6下iptables配置Xtables-Addons和GeoIP屏蔽某个国家ip例子,希望文章对各位有帮助.

 
 

今天服务器上流量猛增,ip都来自于中国,而且是非正常访问的ip,导致php-fpm耗CPU 100%,网站打开非常慢,本来已经使用iptables限制连接数,但由于同一ip的连接数达不到,所以没办法进行限制,只能采用屏蔽某个地区ip的方法了,Xtables-Addons就是这样的模块,只需要编译此模块,而不必编译系统内核,就可以和iptables一起工作,达到过滤某个地区的ip。

第一步,检查系统iptables版本,Xtables-Addons要与iptables版本一致,例如iptables是1.4.7,就需要对应在的Xtables-Addons 1.47
# uname -r
2.6.32-358.18.1.el6.x86_64
# iptables -V
iptables v1.4.7

那么就要下载Xtables-Addons 1.47了。

另外需要关闭selinux,编辑/etc/selinux/config,修改为disabled,并使其生效:echo 0 > /selinux/enforce。

第二步,安装perl-Text-CSV_XS依赖包
# yum install gcc gcc-c++ make automake unzip zip xz kernel-devel-`uname -r` iptables-devel
# rpm -Uvh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
# yum -y install perl-Text-CSV_XS

第三步,下载和编译xtables-addons模块
# wget http://sourceforge.net/projects/xtables-addons/files/Xtables-addons/1.47/xtables-addons-1.47.tar.xz/download
# tar xf xtables-addons-1.47.tar.xz
# cd xtables-addons-1.47
# ./configure
# make
# make install

假如在./configure时遇到错误,configure: error: Package requirements (xtables >= 1.4.5) were not met: No package 'xtables' found:
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for style of include used by make... GNU
checking dependency style of gcc... gcc3
checking whether gcc and cc understand -c and -o together... yes
checking for ar... ar
checking the archiver (ar) interface... ar
checking build system type... x86_64-unknown-linux-gnu
checking host system type... x86_64-unknown-linux-gnu
checking how to print strings... printf
checking for a sed that does not truncate output... /bin/sed
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for fgrep... /bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1966080
checking whether the shell understands some XSI constructs... yes
checking whether the shell understands "+="... yes
checking how to convert x86_64-unknown-linux-gnu file names to x86_64-unknown-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-unknown-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %sn
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for mt... no
checking if : is a manifest tool... no
checking how to run the C preprocessor... gcc -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... no
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... no
checking linux/netfilter/x_tables.h usability... yes
checking linux/netfilter/x_tables.h presence... yes
checking for linux/netfilter/x_tables.h... yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking for libxtables... no
configure: error: Package requirements (xtables >= 1.4.5) were not met:
 
No package 'xtables' found
 
Consider adjusting the PKG_CONFIG_PATH environment variable if you
installed software in a non-standard prefix.
 
Alternatively, you may set the environment variables libxtables_CFLAGS
and libxtables_LIBS to avoid the need to call pkg-config.
See the pkg-config man page for more details.
请安装iptables开发包iptables-devel:
# yum -y install iptables-devel

第四步,下载和安装GeoIP模块,你可以到http://geolite.maxmind.com/download/geoip/database/下载CSV版本,也可以使用xtables-addons目录下geoip目录下的脚本xt_geoip_dl来下载:
# cd geoip/
# ./xt_geoip_dl

将会下载GeoIPv6.csv.gz和GeoIPCountryCSV.zip,并解压缩,得到ip库文件GeoIPv6.csv和GeoIPCountryWhois.csv,接下来就是使用xt_geoip_build编译数据库:
# mkdir -p /usr/share/xt_geoip/                    #创建数据库文件默认存放位置
# ./xt_geoip_build -D /usr/share/xt_geoip *.csv    #编译数据库文件

完成后,将会生成两个目录BE和LE,目录下保存的文件分别有.iv6和.iv4。

第五步,添加过滤规则,屏蔽中国地区ip:
# iptables -I INPUT -m geoip --src-cc CN -j DROP   #注意,这将屏蔽所有端口访问
# iptables -I INPUT -p tcp -m tcp --dport 80 -m geoip --src-cc CN -j DROP    #只屏蔽80端口访问

此时,中国地区已经无法访问网站了,可以保存了:service iptables save

时间: 2024-12-24 10:47:41

Centos6下iptables配置Xtables-Addons和GeoIP屏蔽某个国家ip的相关文章

linux下IPTABLES配置详解

转自:http://www.cnblogs.com/duanxz/p/3994846.html 一.检查iptablesservice iptables status若提示为iptables:unrecognized service,则需要安装.VPS.GL提供的Linux系统都已经安装了iptables防火墙.同时,为了适应广大使用Linux朋友的需要,这里就告诉大家安装步骤.二.快速安装iptables apt-get install iptables  //Debian,Ubuntu使用此

Centos6防火墙iptables配置

配置Centos6.x系列的防火墙iptables的配置参数: 系统环境: [root@hk service]# uname -m x86_64 [root@hk service]# cat /etc/redhat-release CentOS release 6.6 (Final) [root@hk service]# uname -a Linux www.111cn.net 2.6.32-042stab113.11 #1 SMP Fri Dec 18 17:32:04 MSK 2015 x8

centos6下安装配置svn环境步骤

人有时真的很懒,为了方便,使用yum安装svn 以下操作均使用root帐号执行: yum install http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm yum install --enablerepo=rpmforge,rpmforge-extras subversion 建立启动svn运行用户: useradd svn passwd svn 回车后输入两次密码. mkd

linux利用iptables添加扩展模块实现封P2P、封国家IP

在iptables上添加ipp2p模块需要:iptables ≥ 1.4.3.内核≥ 2.6.29. 在编译ipp2p这个扩展的时候我被CentOS的2.6.32-573.3.1.el6.centos.plus.x86_64这个内核坑了,这个内核是yum update的时候安装上去的,最后迫不得已还把自己内核直接升到了4.2.0 这里如果有遇到是2.6.32-573.3.1.el6.centos.plus.x86_64内核的建议直接先升级内核吧. 编译4.2.0内核 [root@LookBack

hadoop-window10下eclipse配置连接centos6.5下的Hadoop2.6失败

问题描述 window10下eclipse配置连接centos6.5下的Hadoop2.6失败 如图所示,eclipse配置后进度条一直在走,报错如下图.总之连不上hdfs. 1.eclipse配置的用户名跟centos的用户名一致. 2.eclipse的plugins里放入了hadoop-eclipse-plugin-2.6.0.jar. 3.将centos中hadoop的安装包拷贝出来到e:中,eclipse配置installation:E:hadoop-2.6.0. 请大家帮忙看看到底为啥

centOS7 下利用iptables配置IP地址白名单的方法_Linux

编辑iptables配置文件,将文件内容更改为如下,则具备了ip地址白名单功能 #vim /etc/sysconfig/iptables *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -N whitelist -A whitelist -s 1.2.3.0/24 -j ACCEPT -A whitelist -s 4.5.6.7 -j ACCEPT -A INPUT -m state --state

Centos6.3 x64中用iptables配置网关防火墙详解

系统环境:centos6.3 x64 IPTABLES:系统自带 一.部署环境: 1.关闭SELINUX # setenforce 0 # vi /etc/sysconfig/selinux --------------- SELINUX=disabled --------------- 2.清空默认策略并重启iptables # iptables -t NAT -F # iptables -F # service iptables save # service iptables restart

Centos6.5 ssh配置与使用教程_Linux

下面给大家介绍centos6.5 ssh配置与使用教程的知识,具体详情如下所示: #rpm -qa |grep ssh 检查是否装了SSH包 #yum install openssh-server 没有的话,安装SSH服务 #chkconfig --list sshd 检查SSHD是否在本运行级别下设置为开机启动 #chkconfig --level 2345 sshd on 如果没设置启动就设置下 #service sshd restart 重新启动SSHD #netstat -antp |g

CentOS下安装配置Tomcat环境

  CentOS下安装配置Tomcat 演示环境 系统:Linux CentOS 6.3 32位 环境:无安装apache.php.mysql 账号:Root 一.下载相关安装包 注:可以先进入 #cd /usr/local/ /进里面后再下载(也可以根据自己情况而定) 1.下载jdk 2.下载Tomcat 二.安装JDK和Tomcat 注:可以先进入 #cd /usr/local/ /再执行下面的命令 1.编译安装Jdk #chmod 777 jdk-6u41-linux-i586-rpm.b