yanistyle/AS_Network_List
1
0
Fork 0
mirror of https://github.com/C24Be/AS_Network_List.git synced 2026-03-30 06:08:50 +03:00
Code Issues Packages Projects Releases Wiki Activity

readme files

Browse Source
This commit is contained in:
C24Be
2026-03-26 10:37:06 +01:00
parent 3922acb075
commit 760bc7409d
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
blacklists_iptables/README.md
View File

@@ -20,14 +20,16 @@ ipset restore < blacklist-v4.ipset
ipset restore < blacklist-v6.ipset
```
Apply inbound rules to traffic connecting to the VM:
Apply inbound rules to traffic connecting to the VM and forwarded through the host:
```bash
iptables -I INPUT -m set --match-set blacklist-v4 src -m conntrack --ctstate NEW -j DROP
iptables -I FORWARD -m set --match-set blacklist-v4 src -m conntrack --ctstate NEW -j DROP
ip6tables -I INPUT -m set --match-set blacklist-v6 src -m conntrack --ctstate NEW -j DROP
ip6tables -I FORWARD -m set --match-set blacklist-v6 src -m conntrack --ctstate NEW -j DROP
```
### 2) Block VK outbound traffic for VPN clients via NAT/FORWARD
### 2) Block VK outbound traffic
Load VK IPv4 and IPv6 sets:
@@ -36,7 +38,14 @@ ipset restore < blacklist-vk-v4.ipset
ipset restore < blacklist-vk-v6.ipset
```
Apply forwarding rules for client egress traffic (replace `<VPN_IFACE>`):
Apply OUTPUT rules for traffic originated on this host:
```bash
iptables -I OUTPUT -m set --match-set blacklist-vk-v4 dst -j REJECT
ip6tables -I OUTPUT -m set --match-set blacklist-vk-v6 dst -j REJECT
```
If you also need to block forwarded VPN-client traffic via NAT, add FORWARD rules (replace `<VPN_IFACE>`):
```bash
iptables -I FORWARD -i <VPN_IFACE> -m set --match-set blacklist-vk-v4 dst -j REJECT