From a3a5ec2ea86d2c9ceaae08d42565ea1f97d5fd99 Mon Sep 17 00:00:00 2001 From: Alexander Serkin Date: Mon, 12 Jan 2026 12:46:07 +0300 Subject: [PATCH] Add nftables support with config generator and IP checker (#22) * Add nftables support with config generator and IP checker - Add generate_nft_blacklist.py for generating nftables configurations - Add check_nft_blacklist.py for verifying IPs against blacklist - Add blacklists_updater_nftables.sh for automated updates - Add blacklists_nftables/ directory with generated configs - Add GitHub Actions workflow for daily nftables updates - Update README.md with nftables usage instructions nftables is a modern replacement for iptables with better performance and lower memory usage, especially for large rulesets. This addition complements the existing iptables and nginx blacklist formats. * Added nftables scripts help --- .github/workflows/update_nftables.yml | 33 + README.md | 31 + blacklists_nftables/README.md | 185 ++++++ blacklists_nftables/blacklist-v4.nft | 844 +++++++++++++++++++++++++ blacklists_nftables/blacklist-v6.nft | 45 ++ blacklists_nftables/blacklist.nft | 864 ++++++++++++++++++++++++++ blacklists_updater_nftables.sh | 35 ++ check_nft_blacklist.py | 113 ++++ generate_nft_blacklist.py | 155 +++++ 9 files changed, 2305 insertions(+) create mode 100644 .github/workflows/update_nftables.yml create mode 100644 blacklists_nftables/README.md create mode 100644 blacklists_nftables/blacklist-v4.nft create mode 100644 blacklists_nftables/blacklist-v6.nft create mode 100644 blacklists_nftables/blacklist.nft create mode 100755 blacklists_updater_nftables.sh create mode 100755 check_nft_blacklist.py create mode 100755 generate_nft_blacklist.py diff --git a/.github/workflows/update_nftables.yml b/.github/workflows/update_nftables.yml new file mode 100644 index 0000000..8ac4f4e --- /dev/null +++ b/.github/workflows/update_nftables.yml @@ -0,0 +1,33 @@ +name: Update nftables Blacklists + +on: + schedule: + - cron: '30 2 * * *' # Daily at 02:30 UTC + workflow_dispatch: + +jobs: + update-nftables: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.x' + + - name: Generate nftables blacklists + run: | + chmod +x blacklists_updater_nftables.sh + ./blacklists_updater_nftables.sh + + - name: Commit and push if changed + run: | + git config --local user.email "github-actions[bot]@users.noreply.github.com" + git config --local user.name "github-actions[bot]" + git add blacklists_nftables/ + git diff --quiet && git diff --staged --quiet || \ + (git commit -m "Auto-update nftables blacklists [skip ci]" && git push) + diff --git a/README.md b/README.md index 8c68a67..ff83233 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,14 @@ This repository contains Python scripts that allow you to retrieve network lists - `blacklist-v6.ipset`: IPSet configuration for IPv6 only (**daily generated**) - `README.md`: Complete usage documentation for iptables integration +**nftables Format** (`blacklists_nftables/` folder): + +* `blacklist.nft`: nftables configuration for mixed IPv4/IPv6 (**daily generated**) +* `blacklist-v4.nft`: nftables configuration for IPv4 only (**daily generated**) +* `blacklist-v6.nft`: nftables configuration for IPv6 only (**daily generated**) +* `README.md`: Complete usage documentation for nftables integration + + ### Reference Lists **Contributors are welcome!** @@ -90,6 +98,15 @@ iptables -I INPUT -m set --match-set blacklist-v4 src -j DROP ip6tables -I INPUT -m set --match-set blacklist-v6 src -j DROP ``` +**For nftables:** +````bash +# Download and load into nftables +wget https://raw.githubusercontent.com/C24Be/AS_Network_List/main/blacklists_nftables/blacklist.nft +sudo nft -f blacklist.nft +# View the loaded rules +sudo nft list ruleset +```` + **For Custom Applications:** ```bash @@ -183,6 +200,20 @@ See the README files in each folder for detailed usage instructions. ./network_list_from_netname.py --help ``` +### `generate_nft_blacklist.py` +1. Generate nftables config from blacklist: + + ```bash + ./generate_nft_blacklist.py blacklists/blacklist.txt blacklist.nft + ``` + +### `check_nft_blacklist.py` +1. Check IP address against generated config: + + ```bash + ./check_nft_blacklist.py blacklist.nft 77.37.166.239 + ``` + ## Screenshots image diff --git a/blacklists_nftables/README.md b/blacklists_nftables/README.md new file mode 100644 index 0000000..3b1b244 --- /dev/null +++ b/blacklists_nftables/README.md @@ -0,0 +1,185 @@ +# nftables Blacklist Configuration + +This folder contains nftables blacklist configurations generated from Russian government agency network lists. + +## Available Files + +- `blacklist.nft` - Mixed IPv4/IPv6 blacklist (**daily generated**) +- `blacklist-v4.nft` - IPv4-only blacklist (**daily generated**) +- `blacklist-v6.nft` - IPv6-only blacklist (**daily generated**) + +## Quick Start + +### Download and Load +````bash +# Download the blacklist +wget https://raw.githubusercontent.com/C24Be/AS_Network_List/main/blacklists_nftables/blacklist.nft + +# Load the configuration +sudo nft -f blacklist.nft + +# Verify it's loaded +sudo nft list ruleset +```` + +### Automatic Updates + +Add to crontab for daily updates: +````bash +0 2 * * * wget -O /etc/nftables.d/blacklist.nft https://raw.githubusercontent.com/C24Be/AS_Network_List/main/blacklists_nftables/blacklist.nft && nft -f /etc/nftables.d/blacklist.nft +```` + +## Configuration Details + +The generated nftables configuration uses: +- **Sets with interval flag** for efficient CIDR matching +- **Named sets** (`blacklist_v4` and `blacklist_v6`) for easy management +- **Counter** directive to track dropped packets +- **Stateful filtering** to allow established connections + +### Configuration Structure +table inet filter { +set blacklist_v4 { +type ipv4_addr +flags interval +elements = { 1.2.3.0/24, 5.6.7.0/24, ... } +} +set blacklist_v6 { + type ipv6_addr + flags interval + elements = { 2001:db8::/32, ... } +} + +chain input { + type filter hook input priority 0; + policy accept; + + ct state { established, related } accept + + ip saddr @blacklist_v4 counter drop + ip6 saddr @blacklist_v6 counter drop +} +} + +## Integration Options + +### Option 1: Standalone Configuration + +Load the blacklist as a complete ruleset: +````bash +sudo nft -f blacklist.nft +```` + +### Option 2: Include in Existing Configuration + +If you have an existing nftables configuration: + +1. Copy only the set definitions from the generated file +2. Add set lookups to your existing input chain: +````bash +ip saddr @blacklist_v4 counter drop +ip6 saddr @blacklist_v6 counter drop +```` + +### Option 3: Persistent Configuration + +For systemd-based systems: +````bash +# Copy to nftables config directory +sudo cp blacklist.nft /etc/nftables.d/ + +# Edit /etc/nftables.conf to include: +# include "/etc/nftables.d/blacklist.nft" + +# Enable and restart +sudo systemctl enable nftables +sudo systemctl restart nftables +```` + +## Checking IPs Against the Blacklist + +Use the `check_nft_blacklist.py` script to verify if an IP is blocked: +````bash +# Check an IPv4 address +python3 check_nft_blacklist.py blacklist.nft 192.168.1.1 + +# Check an IPv6 address +python3 check_nft_blacklist.py blacklist.nft 2001:db8::1 +```` + +## Monitoring + +### View Dropped Packets +````bash +# View all rules with counters +sudo nft list chain inet filter input -a + +# Monitor in real-time +sudo nft monitor +```` + +### Check Set Contents +````bash +# View IPv4 blacklist +sudo nft list set inet filter blacklist_v4 + +# View IPv6 blacklist +sudo nft list set inet filter blacklist_v6 +```` + +## Advantages of nftables + +- **Better Performance**: O(1) lookup time with sets vs O(n) for sequential rules +- **Lower Memory Usage**: More efficient than iptables for large rulesets +- **Atomic Updates**: All rules updated in a single transaction +- **Modern Syntax**: Cleaner, more readable configuration +- **Unified Tool**: Single tool for IPv4, IPv6, and ARP filtering + +## File Format Comparison + +| Format | Use Case | Performance | Memory | +|--------|----------|-------------|--------| +| **nftables** | Modern firewalls | Excellent | Low | +| **iptables** | Legacy systems | Good | Medium | +| **nginx** | Web layer | Good | Low | + +## Troubleshooting + +### Configuration Won't Load +````bash +# Check syntax +sudo nft -c -f blacklist.nft + +# View detailed errors +sudo nft -f blacklist.nft 2>&1 | less +```` + +### Rules Not Blocking Traffic +````bash +# Verify sets are populated +sudo nft list set inet filter blacklist_v4 | wc -l + +# Check rule priority +sudo nft list chain inet filter input + +# Test with logging temporarily +sudo nft add rule inet filter input ip saddr @blacklist_v4 log prefix "BLOCKED: " +```` + +### Performance Issues + +If experiencing performance problems with very large sets: + +1. Consider splitting into multiple smaller sets +2. Use `blacklist-v4.nft` or `blacklist-v6.nft` if only one protocol is needed +3. Ensure kernel supports nftables fully (Linux 4.0+) + +## Additional Resources + +- [nftables Wiki](https://wiki.nftables.org/) +- [nftables Quick Reference](https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes) +- [Netfilter Documentation](https://www.netfilter.org/documentation/) + +## Contributing + +Found an issue or have suggestions? Please open an issue or submit a pull request! diff --git a/blacklists_nftables/blacklist-v4.nft b/blacklists_nftables/blacklist-v4.nft new file mode 100644 index 0000000..d383ebe --- /dev/null +++ b/blacklists_nftables/blacklist-v4.nft @@ -0,0 +1,844 @@ +# Autogenerated nftables blacklist +# Generated: 2026-01-12T09:09:01.967693Z +# Source: /tmp/blacklist-v4.txt +# IPv4: 816, IPv6: 0 + +table inet filter { + + set blacklist_v4 { + type ipv4_addr + flags interval + elements = { + 5.61.16.0/21, + 5.61.232.0/21, + 5.101.40.0/22, + 5.181.60.0/22, + 5.188.140.0/22, + 31.44.63.64/29, + 31.177.95.0/24, + 31.177.104.0/22, + 37.28.161.48/30, + 37.29.53.16/30, + 37.29.57.52/30, + 37.29.57.64/30, + 37.29.59.56/30, + 37.139.32.0/22, + 37.139.40.0/22, + 45.84.128.0/22, + 45.136.20.0/22, + 46.20.70.160/28, + 46.29.152.0/22, + 46.46.142.160/28, + 46.46.148.40/29, + 46.47.197.128/30, + 46.47.199.76/30, + 46.47.203.52/30, + 46.47.207.96/30, + 46.47.208.84/30, + 46.47.210.76/30, + 46.47.211.0/24, + 46.47.212.204/30, + 46.47.213.0/24, + 46.47.214.200/30, + 46.47.219.200/30, + 46.47.223.196/30, + 46.47.229.0/28, + 46.47.238.144/30, + 46.47.249.176/29, + 46.61.208.0/24, + 46.228.0.232/29, + 62.5.130.104/29, + 62.5.132.224/29, + 62.5.189.80/29, + 62.5.202.60/30, + 62.5.218.204/30, + 62.5.224.188/30, + 62.5.242.80/28, + 62.28.169.168/30, + 62.33.34.16/28, + 62.33.87.128/28, + 62.33.87.152/29, + 62.33.199.80/29, + 62.63.96.32/28, + 62.63.98.24/29, + 62.63.100.160/30, + 62.63.101.80/29, + 62.76.98.0/24, + 62.105.158.200/29, + 62.112.110.64/28, + 62.118.0.208/28, + 62.118.15.16/28, + 62.118.17.152/29, + 62.118.19.40/30, + 62.118.19.112/30, + 62.118.21.160/29, + 62.118.25.112/28, + 62.118.37.4/30, + 62.118.37.168/30, + 62.118.37.180/30, + 62.118.38.212/30, + 62.118.101.184/29, + 62.118.113.232/29, + 62.118.125.188/30, + 62.118.127.240/28, + 62.118.193.8/29, + 62.118.205.68/30, + 62.118.208.100/30, + 62.118.209.192/30, + 62.118.216.60/30, + 62.118.219.184/30, + 62.118.230.4/30, + 62.118.233.224/29, + 62.118.234.64/29, + 62.118.239.128/29, + 62.141.125.0/25, + 62.217.160.0/20, + 77.34.209.160/28, + 77.35.76.80/28, + 77.35.98.240/28, + 77.37.128.0/17, + 77.72.139.0/28, + 77.82.124.112/29, + 77.243.9.80/28, + 78.24.159.48/29, + 78.37.67.24/29, + 78.37.69.160/27, + 78.37.84.120/29, + 78.37.97.88/29, + 78.37.104.0/29, + 78.107.3.208/28, + 78.107.13.208/28, + 78.107.16.96/28, + 78.107.18.112/28, + 78.107.40.160/28, + 78.107.42.144/28, + 78.107.51.16/28, + 78.107.61.96/28, + 78.107.86.32/28, + 78.108.192.0/21, + 78.108.200.0/24, + 78.109.140.112/29, + 79.133.74.160/30, + 79.133.74.168/30, + 79.133.75.44/30, + 79.133.75.176/30, + 79.137.132.0/24, + 79.137.139.0/24, + 79.137.140.0/24, + 79.137.142.0/24, + 79.137.157.0/24, + 79.137.164.0/24, + 79.137.167.0/24, + 79.137.174.0/23, + 79.137.180.0/24, + 79.137.183.0/24, + 79.137.240.0/21, + 79.142.88.0/28, + 79.143.229.0/24, + 79.143.230.0/24, + 79.143.232.0/24, + 80.73.16.0/20, + 80.73.168.80/28, + 80.73.169.244/30, + 80.82.43.24/29, + 80.89.152.220/30, + 80.237.11.88/29, + 80.237.39.112/29, + 80.237.98.80/28, + 80.247.32.0/20, + 80.254.100.40/29, + 80.254.119.168/29, + 81.1.195.0/28, + 81.1.205.96/27, + 81.2.1.0/28, + 81.2.10.192/27, + 81.3.168.148/30, + 81.17.2.192/28, + 81.17.3.16/29, + 81.176.70.0/26, + 81.176.235.0/27, + 81.177.12.0/24, + 81.177.31.64/26, + 81.177.156.0/24, + 81.195.36.48/28, + 81.195.44.248/30, + 81.195.45.64/30, + 81.195.50.72/29, + 81.195.90.44/30, + 81.195.92.48/30, + 81.195.93.192/27, + 81.195.94.72/29, + 81.195.105.160/28, + 81.195.108.164/30, + 81.195.112.36/30, + 81.195.118.48/30, + 81.195.118.128/30, + 81.195.120.16/29, + 81.195.124.52/30, + 81.195.125.96/30, + 81.195.148.140/30, + 81.195.150.248/30, + 81.195.151.172/30, + 81.195.155.0/30, + 81.195.161.12/30, + 81.195.165.64/28, + 81.195.168.24/30, + 81.195.177.160/30, + 81.195.178.224/27, + 81.195.182.64/28, + 81.195.192.96/30, + 81.195.231.128/26, + 81.195.244.32/29, + 81.195.245.0/28, + 81.195.247.128/28, + 81.195.250.16/29, + 81.211.32.16/28, + 81.222.194.200/29, + 81.222.209.136/29, + 81.222.210.24/29, + 82.110.69.200/29, + 82.140.65.240/29, + 82.142.162.104/29, + 82.151.107.136/29, + 82.162.72.208/28, + 82.162.76.176/28, + 82.162.80.192/28, + 82.162.87.192/28, + 82.162.90.0/28, + 82.162.103.144/28, + 82.162.126.96/28, + 82.162.149.160/28, + 82.162.157.64/28, + 82.162.158.176/28, + 82.162.172.112/28, + 82.179.86.32/27, + 82.196.69.152/30, + 82.196.130.0/27, + 82.198.176.16/29, + 82.198.176.144/29, + 82.198.176.208/29, + 82.198.189.128/26, + 82.198.190.64/26, + 82.198.191.96/27, + 82.198.191.248/29, + 82.200.13.0/27, + 82.200.22.136/29, + 82.200.22.144/28, + 82.200.64.0/24, + 82.208.68.240/28, + 82.208.77.104/29, + 82.208.81.0/24, + 82.208.93.160/27, + 83.69.207.248/29, + 83.149.42.64/29, + 83.166.232.0/21, + 83.166.248.0/21, + 83.172.36.224/29, + 83.217.216.0/22, + 83.219.5.248/29, + 83.219.6.72/29, + 83.219.13.128/29, + 83.219.13.184/29, + 83.219.23.8/29, + 83.219.23.48/29, + 83.219.25.0/29, + 83.219.25.112/29, + 83.219.138.16/28, + 83.220.53.16/28, + 83.222.28.0/22, + 83.229.181.192/26, + 83.229.232.16/29, + 84.23.52.0/22, + 84.53.210.144/28, + 84.204.7.144/29, + 84.204.93.232/30, + 84.204.143.44/30, + 84.204.154.16/30, + 84.204.170.220/30, + 84.204.217.164/30, + 84.204.245.208/29, + 85.21.99.48/28, + 85.21.99.64/28, + 85.21.102.224/28, + 85.21.103.64/28, + 85.21.104.192/27, + 85.21.148.0/26, + 85.21.149.48/28, + 85.21.155.208/28, + 85.21.157.48/28, + 85.21.204.208/28, + 85.90.98.144/30, + 85.90.99.168/29, + 85.90.100.72/29, + 85.90.101.112/28, + 85.90.101.192/29, + 85.90.102.168/29, + 85.90.120.72/29, + 85.90.121.72/29, + 85.90.125.96/29, + 85.90.127.16/29, + 85.94.52.160/27, + 85.94.53.32/28, + 85.114.30.192/30, + 85.114.30.204/30, + 85.114.31.108/30, + 85.114.93.88/29, + 85.141.17.24/30, + 85.141.17.112/30, + 85.141.18.80/30, + 85.141.19.56/30, + 85.141.21.236/30, + 85.141.28.0/30, + 85.141.31.68/30, + 85.141.32.96/28, + 85.141.33.0/28, + 85.141.33.64/28, + 85.141.60.96/28, + 85.141.61.160/28, + 85.143.125.0/24, + 85.192.32.0/22, + 85.198.106.0/23, + 85.236.29.160/27, + 86.102.72.240/28, + 86.102.74.64/28, + 86.102.100.48/28, + 86.102.108.32/28, + 86.102.109.32/27, + 86.102.115.80/28, + 86.102.126.80/28, + 86.102.126.160/28, + 87.117.18.144/29, + 87.117.20.64/26, + 87.117.20.128/28, + 87.117.21.0/26, + 87.117.21.64/28, + 87.117.21.80/29, + 87.117.23.128/28, + 87.117.31.56/29, + 87.225.56.224/28, + 87.226.156.64/26, + 87.226.191.0/24, + 87.226.213.0/24, + 87.226.239.180/30, + 87.237.47.204/30, + 87.239.104.0/21, + 87.240.128.0/18, + 87.242.112.0/22, + 87.245.133.0/24, + 87.249.3.64/28, + 87.249.5.48/30, + 87.249.7.120/29, + 87.249.16.32/28, + 87.249.18.60/30, + 87.249.22.72/29, + 87.249.28.232/29, + 87.249.30.176/30, + 88.83.195.248/30, + 88.151.200.0/24, + 88.200.208.112/29, + 89.21.129.16/28, + 89.21.140.104/29, + 89.21.152.104/29, + 89.28.253.168/29, + 89.28.255.56/29, + 89.106.172.160/29, + 89.107.123.120/29, + 89.107.123.136/29, + 89.107.127.136/29, + 89.109.7.176/29, + 89.109.250.28/30, + 89.109.250.80/30, + 89.109.250.88/29, + 89.109.250.96/30, + 89.109.250.132/30, + 89.109.250.140/30, + 89.111.176.0/22, + 89.175.6.64/27, + 89.175.8.36/30, + 89.175.8.40/29, + 89.175.8.52/30, + 89.175.8.68/30, + 89.175.8.104/30, + 89.175.8.140/30, + 89.175.8.192/30, + 89.175.9.4/30, + 89.175.10.160/30, + 89.175.165.208/28, + 89.175.170.144/28, + 89.175.174.136/29, + 89.175.176.88/30, + 89.175.176.140/30, + 89.175.176.176/30, + 89.175.188.184/29, + 89.179.155.192/28, + 89.179.179.16/28, + 89.179.181.0/24, + 89.208.84.0/22, + 89.208.196.0/22, + 89.208.208.0/22, + 89.208.216.0/21, + 89.208.228.0/22, + 89.221.228.0/22, + 89.221.232.0/21, + 90.150.176.52/30, + 90.150.189.32/29, + 90.150.189.128/26, + 90.150.189.192/27, + 90.150.189.224/28, + 90.150.189.248/29, + 90.156.148.0/22, + 90.156.212.0/22, + 90.156.216.0/22, + 90.156.232.0/21, + 90.156.248.0/22, + 91.103.194.184/29, + 91.135.212.0/22, + 91.135.216.0/21, + 91.195.136.0/23, + 91.208.20.0/24, + 91.215.168.0/22, + 91.217.34.0/23, + 91.219.192.0/22, + 91.219.224.0/22, + 91.221.140.0/23, + 91.226.250.0/24, + 91.227.32.0/24, + 91.231.132.0/22, + 91.237.76.0/24, + 92.39.106.20/30, + 92.39.106.168/30, + 92.39.111.84/30, + 92.39.128.0/21, + 92.50.198.72/30, + 92.50.198.124/30, + 92.50.219.136/29, + 92.50.238.224/29, + 92.101.253.96/29, + 92.101.253.152/29, + 93.153.134.112/29, + 93.153.135.88/30, + 93.153.136.132/30, + 93.153.142.4/30, + 93.153.144.60/30, + 93.153.171.204/30, + 93.153.172.100/30, + 93.153.175.44/30, + 93.153.183.104/30, + 93.153.194.160/29, + 93.153.220.192/29, + 93.153.223.8/29, + 93.153.229.232/29, + 93.153.244.188/30, + 93.153.244.248/29, + 93.153.251.0/24, + 93.153.255.84/30, + 93.178.104.32/29, + 93.178.104.64/29, + 93.178.106.0/26, + 93.186.224.0/20, + 93.188.20.72/29, + 93.190.110.0/24, + 94.25.53.56/29, + 94.25.57.176/29, + 94.25.57.224/28, + 94.25.65.16/29, + 94.25.70.64/30, + 94.25.90.240/29, + 94.25.95.136/30, + 94.25.119.228/30, + 94.100.176.0/20, + 94.124.192.192/29, + 94.139.244.0/22, + 94.199.64.0/21, + 95.53.248.0/29, + 95.54.193.80/28, + 95.142.192.0/20, + 95.163.32.0/19, + 95.163.133.0/24, + 95.163.180.0/22, + 95.163.208.0/21, + 95.163.216.0/22, + 95.163.248.0/21, + 95.167.2.4/30, + 95.167.4.168/29, + 95.167.5.64/27, + 95.167.21.104/29, + 95.167.29.104/29, + 95.167.54.76/30, + 95.167.59.244/30, + 95.167.64.20/30, + 95.167.68.216/29, + 95.167.69.116/30, + 95.167.70.32/28, + 95.167.70.136/29, + 95.167.70.176/28, + 95.167.72.48/30, + 95.167.72.140/30, + 95.167.72.204/30, + 95.167.74.136/29, + 95.167.74.180/30, + 95.167.76.160/27, + 95.167.99.48/28, + 95.167.113.48/30, + 95.167.114.48/30, + 95.167.121.68/30, + 95.167.122.128/28, + 95.167.142.32/30, + 95.167.157.156/30, + 95.167.162.76/30, + 95.167.162.236/30, + 95.167.176.0/23, + 95.167.213.0/24, + 95.173.128.0/19, + 95.213.0.0/17, + 109.73.4.224/27, + 109.120.180.0/22, + 109.120.188.0/22, + 109.124.66.128/30, + 109.124.66.160/28, + 109.124.71.64/29, + 109.124.78.108/30, + 109.124.80.132/30, + 109.124.83.20/30, + 109.124.87.96/29, + 109.124.89.36/30, + 109.124.89.140/30, + 109.124.89.212/30, + 109.124.90.32/30, + 109.124.90.128/30, + 109.124.97.4/30, + 109.124.99.16/30, + 109.124.99.160/28, + 109.124.119.88/29, + 109.204.204.232/29, + 109.207.0.0/20, + 109.232.187.16/29, + 109.248.197.0/24, + 128.140.168.0/21, + 130.49.224.0/19, + 145.255.238.240/28, + 146.185.208.0/22, + 146.185.240.0/22, + 149.62.55.240/30, + 155.212.192.0/20, + 176.109.0.0/21, + 176.112.168.0/21, + 176.116.96.0/20, + 178.16.156.148/30, + 178.17.176.0/20, + 178.20.234.224/29, + 178.22.88.0/21, + 178.49.148.176/29, + 178.237.16.0/20, + 178.237.206.0/24, + 178.237.240.0/20, + 178.248.232.60/32, + 178.248.232.137/32, + 178.248.233.26/32, + 178.248.233.32/32, + 178.248.233.60/32, + 178.248.233.136/32, + 178.248.233.244/31, + 178.248.234.30/32, + 178.248.234.33/32, + 178.248.234.60/32, + 178.248.234.79/32, + 178.248.234.83/32, + 178.248.234.136/32, + 178.248.234.204/32, + 178.248.234.228/32, + 178.248.234.238/32, + 178.248.235.60/32, + 178.248.235.75/32, + 178.248.235.244/32, + 178.248.236.20/32, + 178.248.236.83/32, + 178.248.236.244/32, + 178.248.237.18/32, + 178.248.237.98/32, + 178.248.237.136/32, + 178.248.237.242/32, + 178.248.238.55/32, + 178.248.238.102/32, + 178.248.238.128/31, + 178.248.238.136/32, + 178.248.238.155/32, + 178.248.238.172/32, + 178.248.238.205/32, + 178.248.238.255/32, + 178.248.239.215/32, + 185.5.136.0/22, + 185.6.244.0/22, + 185.7.234.188/30, + 185.16.8.0/22, + 185.16.148.0/22, + 185.16.244.0/22, + 185.29.128.0/22, + 185.32.248.0/22, + 185.65.149.170/32, + 185.86.144.0/22, + 185.100.104.0/22, + 185.130.112.0/22, + 185.131.68.0/22, + 185.149.160.0/22, + 185.168.60.0/22, + 185.179.224.0/22, + 185.180.200.0/22, + 185.183.172.0/22, + 185.187.63.0/24, + 185.224.228.0/22, + 185.226.52.0/22, + 185.241.192.0/22, + 188.93.56.0/21, + 188.128.8.240/30, + 188.128.11.196/30, + 188.128.89.0/30, + 188.128.92.104/30, + 188.128.94.204/30, + 188.128.98.204/30, + 188.128.101.108/30, + 188.128.112.216/29, + 188.128.112.240/29, + 188.128.113.0/28, + 188.128.114.128/28, + 188.128.115.232/29, + 188.128.118.224/27, + 188.128.119.104/30, + 188.128.122.240/30, + 188.247.36.124/30, + 188.247.36.128/28, + 188.247.36.204/30, + 193.33.230.0/23, + 193.47.146.0/24, + 193.203.40.0/22, + 193.232.70.0/24, + 194.8.70.0/23, + 194.8.246.0/23, + 194.67.63.200/30, + 194.84.16.12/30, + 194.140.247.0/24, + 194.150.202.0/23, + 194.165.22.0/23, + 194.186.63.0/24, + 194.186.112.80/28, + 194.190.9.0/24, + 194.215.248.0/24, + 194.226.80.0/20, + 194.226.116.0/22, + 194.226.127.0/24, + 195.3.240.0/22, + 195.16.55.224/27, + 195.42.75.8/29, + 195.54.20.168/29, + 195.54.28.72/30, + 195.54.221.0/24, + 195.58.5.16/29, + 195.58.13.120/30, + 195.58.21.196/30, + 195.58.29.57/32, + 195.58.30.164/30, + 195.58.30.200/29, + 195.80.224.0/24, + 195.98.38.16/28, + 195.98.43.104/29, + 195.98.73.56/29, + 195.98.77.100/30, + 195.128.157.0/24, + 195.131.7.8/29, + 195.131.53.248/29, + 195.131.61.80/29, + 195.131.63.24/29, + 195.144.226.224/28, + 195.144.232.144/30, + 195.144.240.128/28, + 195.149.110.0/24, + 195.151.25.48/29, + 195.162.36.64/28, + 195.170.218.24/29, + 195.170.218.88/29, + 195.182.142.128/26, + 195.182.145.64/28, + 195.182.151.212/30, + 195.182.151.216/30, + 195.182.155.164/30, + 195.182.156.96/30, + 195.209.120.0/22, + 195.211.20.0/22, + 195.218.175.40/29, + 195.218.190.0/23, + 195.226.203.0/24, + 195.239.80.32/29, + 195.239.113.0/24, + 195.239.247.0/24, + 212.13.104.116/30, + 212.13.113.100/30, + 212.15.105.64/28, + 212.15.114.156/30, + 212.15.115.80/28, + 212.17.8.176/29, + 212.17.9.144/28, + 212.17.16.192/27, + 212.17.17.176/28, + 212.23.85.48/30, + 212.23.85.56/29, + 212.32.198.64/29, + 212.48.34.176/28, + 212.48.53.76/30, + 212.48.53.84/30, + 212.48.53.88/29, + 212.48.53.100/30, + 212.48.53.144/30, + 212.48.53.152/29, + 212.48.53.160/29, + 212.48.53.184/29, + 212.48.53.192/29, + 212.48.53.200/30, + 212.48.53.216/30, + 212.48.53.236/30, + 212.48.53.240/28, + 212.48.54.0/30, + 212.48.54.8/29, + 212.48.54.16/28, + 212.48.54.32/29, + 212.48.54.44/30, + 212.48.54.48/28, + 212.48.54.64/28, + 212.48.54.80/29, + 212.48.54.92/30, + 212.48.54.96/27, + 212.48.54.128/27, + 212.48.54.164/30, + 212.48.54.168/29, + 212.48.54.176/28, + 212.48.54.196/30, + 212.48.54.200/30, + 212.48.54.208/28, + 212.48.54.240/28, + 212.48.134.192/26, + 212.48.138.240/28, + 212.48.141.160/27, + 212.49.107.224/27, + 212.49.124.0/26, + 212.57.133.0/24, + 212.57.159.0/24, + 212.59.98.48/29, + 212.59.99.96/27, + 212.111.84.0/22, + 212.119.174.0/23, + 212.120.169.48/29, + 212.120.174.88/29, + 212.120.184.48/28, + 212.120.184.64/29, + 212.120.189.208/29, + 212.120.189.224/29, + 212.120.190.112/29, + 212.120.190.240/29, + 212.120.191.120/29, + 212.120.191.248/29, + 212.192.156.0/22, + 212.233.72.0/21, + 212.233.88.0/21, + 212.233.96.0/22, + 212.233.120.0/22, + 213.24.34.0/24, + 213.24.75.0/24, + 213.24.76.0/23, + 213.24.128.0/22, + 213.24.143.0/24, + 213.24.152.0/22, + 213.24.160.0/28, + 213.33.171.240/29, + 213.59.59.16/29, + 213.59.59.64/29, + 213.59.59.120/29, + 213.59.59.128/29, + 213.59.59.144/29, + 213.59.59.168/29, + 213.59.91.48/29, + 213.59.91.128/27, + 213.59.91.176/28, + 213.85.2.64/28, + 213.85.2.80/29, + 213.85.20.8/30, + 213.85.20.32/30, + 213.85.20.84/30, + 213.85.77.64/27, + 213.85.142.176/28, + 213.147.55.108/30, + 213.172.4.192/26, + 213.172.17.252/30, + 213.172.18.60/30, + 213.172.18.124/30, + 213.172.18.148/30, + 213.172.18.160/29, + 213.172.18.252/30, + 213.172.27.0/30, + 213.172.27.116/30, + 213.172.27.160/30, + 213.172.27.204/30, + 213.172.27.212/30, + 213.172.27.224/30, + 213.172.27.252/30, + 213.172.30.136/30, + 213.176.232.0/22, + 213.177.111.0/24, + 213.183.253.56/29, + 213.219.212.0/22, + 213.219.237.68/30, + 213.234.8.8/30, + 213.234.13.60/30, + 213.234.15.228/30, + 213.234.15.248/30, + 213.234.18.52/30, + 213.242.204.76/30, + 213.242.204.236/30, + 213.242.205.88/30, + 213.242.215.68/30, + 213.242.215.192/29, + 213.243.84.80/28, + 213.243.106.48/28, + 213.243.116.0/24, + 217.16.16.0/20, + 217.20.86.128/26, + 217.20.86.232/29, + 217.20.144.0/20, + 217.23.88.168/29, + 217.23.88.248/29, + 217.27.142.176/30, + 217.65.214.24/29, + 217.65.219.160/29, + 217.67.177.208/29, + 217.69.128.0/20, + 217.106.0.0/16, + 217.107.5.8/29, + 217.107.5.16/28, + 217.107.5.40/29, + 217.107.5.80/28, + 217.107.5.96/29, + 217.107.5.112/29, + 217.107.200.0/21, + 217.147.23.112/28, + 217.148.216.156/30, + 217.148.220.160/29, + 217.172.18.0/23, + 217.174.188.0/22, + 217.195.92.16/28, + 217.195.93.144/29, + 217.195.94.200/29 + } + } + + set blacklist_v6 { + type ipv6_addr + flags interval + } + + chain input { + type filter hook input priority 0; + policy accept; + + ct state { established, related } accept + + ip saddr @blacklist_v4 counter drop + } +} \ No newline at end of file diff --git a/blacklists_nftables/blacklist-v6.nft b/blacklists_nftables/blacklist-v6.nft new file mode 100644 index 0000000..ca7cf88 --- /dev/null +++ b/blacklists_nftables/blacklist-v6.nft @@ -0,0 +1,45 @@ +# Autogenerated nftables blacklist +# Generated: 2026-01-12T09:09:02.010763Z +# Source: /tmp/blacklist-v6.txt +# IPv4: 0, IPv6: 17 + +table inet filter { + + set blacklist_v4 { + type ipv4_addr + flags interval + } + + set blacklist_v6 { + type ipv6_addr + flags interval + elements = { + 2a00:1148::/29, + 2a00:46e0::/32, + 2a00:a300::/32, + 2a00:b4c0::/32, + 2a00:bdc0::/33, + 2a00:bdc0:8000::/34, + 2a00:bdc0:c000::/35, + 2a00:bdc0:e002::/47, + 2a00:bdc0:e004::/47, + 2a00:bdc0:e007::/48, + 2a00:bdc0:f000::/36, + 2a00:bdc1::/32, + 2a00:bdc2::/31, + 2a00:bdc4::/30, + 2a14:25c0::/32, + 2a14:25c5::/32, + 2a14:25c6::/31 + } + } + + chain input { + type filter hook input priority 0; + policy accept; + + ct state { established, related } accept + + ip6 saddr @blacklist_v6 counter drop + } +} \ No newline at end of file diff --git a/blacklists_nftables/blacklist.nft b/blacklists_nftables/blacklist.nft new file mode 100644 index 0000000..2b632e9 --- /dev/null +++ b/blacklists_nftables/blacklist.nft @@ -0,0 +1,864 @@ +# Autogenerated nftables blacklist +# Generated: 2026-01-12T09:09:01.912886Z +# Source: /home/user/AS_Network_List/blacklists/blacklist.txt +# IPv4: 816, IPv6: 17 + +table inet filter { + + set blacklist_v4 { + type ipv4_addr + flags interval + elements = { + 5.61.16.0/21, + 5.61.232.0/21, + 5.101.40.0/22, + 5.181.60.0/22, + 5.188.140.0/22, + 31.44.63.64/29, + 31.177.95.0/24, + 31.177.104.0/22, + 37.28.161.48/30, + 37.29.53.16/30, + 37.29.57.52/30, + 37.29.57.64/30, + 37.29.59.56/30, + 37.139.32.0/22, + 37.139.40.0/22, + 45.84.128.0/22, + 45.136.20.0/22, + 46.20.70.160/28, + 46.29.152.0/22, + 46.46.142.160/28, + 46.46.148.40/29, + 46.47.197.128/30, + 46.47.199.76/30, + 46.47.203.52/30, + 46.47.207.96/30, + 46.47.208.84/30, + 46.47.210.76/30, + 46.47.211.0/24, + 46.47.212.204/30, + 46.47.213.0/24, + 46.47.214.200/30, + 46.47.219.200/30, + 46.47.223.196/30, + 46.47.229.0/28, + 46.47.238.144/30, + 46.47.249.176/29, + 46.61.208.0/24, + 46.228.0.232/29, + 62.5.130.104/29, + 62.5.132.224/29, + 62.5.189.80/29, + 62.5.202.60/30, + 62.5.218.204/30, + 62.5.224.188/30, + 62.5.242.80/28, + 62.28.169.168/30, + 62.33.34.16/28, + 62.33.87.128/28, + 62.33.87.152/29, + 62.33.199.80/29, + 62.63.96.32/28, + 62.63.98.24/29, + 62.63.100.160/30, + 62.63.101.80/29, + 62.76.98.0/24, + 62.105.158.200/29, + 62.112.110.64/28, + 62.118.0.208/28, + 62.118.15.16/28, + 62.118.17.152/29, + 62.118.19.40/30, + 62.118.19.112/30, + 62.118.21.160/29, + 62.118.25.112/28, + 62.118.37.4/30, + 62.118.37.168/30, + 62.118.37.180/30, + 62.118.38.212/30, + 62.118.101.184/29, + 62.118.113.232/29, + 62.118.125.188/30, + 62.118.127.240/28, + 62.118.193.8/29, + 62.118.205.68/30, + 62.118.208.100/30, + 62.118.209.192/30, + 62.118.216.60/30, + 62.118.219.184/30, + 62.118.230.4/30, + 62.118.233.224/29, + 62.118.234.64/29, + 62.118.239.128/29, + 62.141.125.0/25, + 62.217.160.0/20, + 77.34.209.160/28, + 77.35.76.80/28, + 77.35.98.240/28, + 77.37.128.0/17, + 77.72.139.0/28, + 77.82.124.112/29, + 77.243.9.80/28, + 78.24.159.48/29, + 78.37.67.24/29, + 78.37.69.160/27, + 78.37.84.120/29, + 78.37.97.88/29, + 78.37.104.0/29, + 78.107.3.208/28, + 78.107.13.208/28, + 78.107.16.96/28, + 78.107.18.112/28, + 78.107.40.160/28, + 78.107.42.144/28, + 78.107.51.16/28, + 78.107.61.96/28, + 78.107.86.32/28, + 78.108.192.0/21, + 78.108.200.0/24, + 78.109.140.112/29, + 79.133.74.160/30, + 79.133.74.168/30, + 79.133.75.44/30, + 79.133.75.176/30, + 79.137.132.0/24, + 79.137.139.0/24, + 79.137.140.0/24, + 79.137.142.0/24, + 79.137.157.0/24, + 79.137.164.0/24, + 79.137.167.0/24, + 79.137.174.0/23, + 79.137.180.0/24, + 79.137.183.0/24, + 79.137.240.0/21, + 79.142.88.0/28, + 79.143.229.0/24, + 79.143.230.0/24, + 79.143.232.0/24, + 80.73.16.0/20, + 80.73.168.80/28, + 80.73.169.244/30, + 80.82.43.24/29, + 80.89.152.220/30, + 80.237.11.88/29, + 80.237.39.112/29, + 80.237.98.80/28, + 80.247.32.0/20, + 80.254.100.40/29, + 80.254.119.168/29, + 81.1.195.0/28, + 81.1.205.96/27, + 81.2.1.0/28, + 81.2.10.192/27, + 81.3.168.148/30, + 81.17.2.192/28, + 81.17.3.16/29, + 81.176.70.0/26, + 81.176.235.0/27, + 81.177.12.0/24, + 81.177.31.64/26, + 81.177.156.0/24, + 81.195.36.48/28, + 81.195.44.248/30, + 81.195.45.64/30, + 81.195.50.72/29, + 81.195.90.44/30, + 81.195.92.48/30, + 81.195.93.192/27, + 81.195.94.72/29, + 81.195.105.160/28, + 81.195.108.164/30, + 81.195.112.36/30, + 81.195.118.48/30, + 81.195.118.128/30, + 81.195.120.16/29, + 81.195.124.52/30, + 81.195.125.96/30, + 81.195.148.140/30, + 81.195.150.248/30, + 81.195.151.172/30, + 81.195.155.0/30, + 81.195.161.12/30, + 81.195.165.64/28, + 81.195.168.24/30, + 81.195.177.160/30, + 81.195.178.224/27, + 81.195.182.64/28, + 81.195.192.96/30, + 81.195.231.128/26, + 81.195.244.32/29, + 81.195.245.0/28, + 81.195.247.128/28, + 81.195.250.16/29, + 81.211.32.16/28, + 81.222.194.200/29, + 81.222.209.136/29, + 81.222.210.24/29, + 82.110.69.200/29, + 82.140.65.240/29, + 82.142.162.104/29, + 82.151.107.136/29, + 82.162.72.208/28, + 82.162.76.176/28, + 82.162.80.192/28, + 82.162.87.192/28, + 82.162.90.0/28, + 82.162.103.144/28, + 82.162.126.96/28, + 82.162.149.160/28, + 82.162.157.64/28, + 82.162.158.176/28, + 82.162.172.112/28, + 82.179.86.32/27, + 82.196.69.152/30, + 82.196.130.0/27, + 82.198.176.16/29, + 82.198.176.144/29, + 82.198.176.208/29, + 82.198.189.128/26, + 82.198.190.64/26, + 82.198.191.96/27, + 82.198.191.248/29, + 82.200.13.0/27, + 82.200.22.136/29, + 82.200.22.144/28, + 82.200.64.0/24, + 82.208.68.240/28, + 82.208.77.104/29, + 82.208.81.0/24, + 82.208.93.160/27, + 83.69.207.248/29, + 83.149.42.64/29, + 83.166.232.0/21, + 83.166.248.0/21, + 83.172.36.224/29, + 83.217.216.0/22, + 83.219.5.248/29, + 83.219.6.72/29, + 83.219.13.128/29, + 83.219.13.184/29, + 83.219.23.8/29, + 83.219.23.48/29, + 83.219.25.0/29, + 83.219.25.112/29, + 83.219.138.16/28, + 83.220.53.16/28, + 83.222.28.0/22, + 83.229.181.192/26, + 83.229.232.16/29, + 84.23.52.0/22, + 84.53.210.144/28, + 84.204.7.144/29, + 84.204.93.232/30, + 84.204.143.44/30, + 84.204.154.16/30, + 84.204.170.220/30, + 84.204.217.164/30, + 84.204.245.208/29, + 85.21.99.48/28, + 85.21.99.64/28, + 85.21.102.224/28, + 85.21.103.64/28, + 85.21.104.192/27, + 85.21.148.0/26, + 85.21.149.48/28, + 85.21.155.208/28, + 85.21.157.48/28, + 85.21.204.208/28, + 85.90.98.144/30, + 85.90.99.168/29, + 85.90.100.72/29, + 85.90.101.112/28, + 85.90.101.192/29, + 85.90.102.168/29, + 85.90.120.72/29, + 85.90.121.72/29, + 85.90.125.96/29, + 85.90.127.16/29, + 85.94.52.160/27, + 85.94.53.32/28, + 85.114.30.192/30, + 85.114.30.204/30, + 85.114.31.108/30, + 85.114.93.88/29, + 85.141.17.24/30, + 85.141.17.112/30, + 85.141.18.80/30, + 85.141.19.56/30, + 85.141.21.236/30, + 85.141.28.0/30, + 85.141.31.68/30, + 85.141.32.96/28, + 85.141.33.0/28, + 85.141.33.64/28, + 85.141.60.96/28, + 85.141.61.160/28, + 85.143.125.0/24, + 85.192.32.0/22, + 85.198.106.0/23, + 85.236.29.160/27, + 86.102.72.240/28, + 86.102.74.64/28, + 86.102.100.48/28, + 86.102.108.32/28, + 86.102.109.32/27, + 86.102.115.80/28, + 86.102.126.80/28, + 86.102.126.160/28, + 87.117.18.144/29, + 87.117.20.64/26, + 87.117.20.128/28, + 87.117.21.0/26, + 87.117.21.64/28, + 87.117.21.80/29, + 87.117.23.128/28, + 87.117.31.56/29, + 87.225.56.224/28, + 87.226.156.64/26, + 87.226.191.0/24, + 87.226.213.0/24, + 87.226.239.180/30, + 87.237.47.204/30, + 87.239.104.0/21, + 87.240.128.0/18, + 87.242.112.0/22, + 87.245.133.0/24, + 87.249.3.64/28, + 87.249.5.48/30, + 87.249.7.120/29, + 87.249.16.32/28, + 87.249.18.60/30, + 87.249.22.72/29, + 87.249.28.232/29, + 87.249.30.176/30, + 88.83.195.248/30, + 88.151.200.0/24, + 88.200.208.112/29, + 89.21.129.16/28, + 89.21.140.104/29, + 89.21.152.104/29, + 89.28.253.168/29, + 89.28.255.56/29, + 89.106.172.160/29, + 89.107.123.120/29, + 89.107.123.136/29, + 89.107.127.136/29, + 89.109.7.176/29, + 89.109.250.28/30, + 89.109.250.80/30, + 89.109.250.88/29, + 89.109.250.96/30, + 89.109.250.132/30, + 89.109.250.140/30, + 89.111.176.0/22, + 89.175.6.64/27, + 89.175.8.36/30, + 89.175.8.40/29, + 89.175.8.52/30, + 89.175.8.68/30, + 89.175.8.104/30, + 89.175.8.140/30, + 89.175.8.192/30, + 89.175.9.4/30, + 89.175.10.160/30, + 89.175.165.208/28, + 89.175.170.144/28, + 89.175.174.136/29, + 89.175.176.88/30, + 89.175.176.140/30, + 89.175.176.176/30, + 89.175.188.184/29, + 89.179.155.192/28, + 89.179.179.16/28, + 89.179.181.0/24, + 89.208.84.0/22, + 89.208.196.0/22, + 89.208.208.0/22, + 89.208.216.0/21, + 89.208.228.0/22, + 89.221.228.0/22, + 89.221.232.0/21, + 90.150.176.52/30, + 90.150.189.32/29, + 90.150.189.128/26, + 90.150.189.192/27, + 90.150.189.224/28, + 90.150.189.248/29, + 90.156.148.0/22, + 90.156.212.0/22, + 90.156.216.0/22, + 90.156.232.0/21, + 90.156.248.0/22, + 91.103.194.184/29, + 91.135.212.0/22, + 91.135.216.0/21, + 91.195.136.0/23, + 91.208.20.0/24, + 91.215.168.0/22, + 91.217.34.0/23, + 91.219.192.0/22, + 91.219.224.0/22, + 91.221.140.0/23, + 91.226.250.0/24, + 91.227.32.0/24, + 91.231.132.0/22, + 91.237.76.0/24, + 92.39.106.20/30, + 92.39.106.168/30, + 92.39.111.84/30, + 92.39.128.0/21, + 92.50.198.72/30, + 92.50.198.124/30, + 92.50.219.136/29, + 92.50.238.224/29, + 92.101.253.96/29, + 92.101.253.152/29, + 93.153.134.112/29, + 93.153.135.88/30, + 93.153.136.132/30, + 93.153.142.4/30, + 93.153.144.60/30, + 93.153.171.204/30, + 93.153.172.100/30, + 93.153.175.44/30, + 93.153.183.104/30, + 93.153.194.160/29, + 93.153.220.192/29, + 93.153.223.8/29, + 93.153.229.232/29, + 93.153.244.188/30, + 93.153.244.248/29, + 93.153.251.0/24, + 93.153.255.84/30, + 93.178.104.32/29, + 93.178.104.64/29, + 93.178.106.0/26, + 93.186.224.0/20, + 93.188.20.72/29, + 93.190.110.0/24, + 94.25.53.56/29, + 94.25.57.176/29, + 94.25.57.224/28, + 94.25.65.16/29, + 94.25.70.64/30, + 94.25.90.240/29, + 94.25.95.136/30, + 94.25.119.228/30, + 94.100.176.0/20, + 94.124.192.192/29, + 94.139.244.0/22, + 94.199.64.0/21, + 95.53.248.0/29, + 95.54.193.80/28, + 95.142.192.0/20, + 95.163.32.0/19, + 95.163.133.0/24, + 95.163.180.0/22, + 95.163.208.0/21, + 95.163.216.0/22, + 95.163.248.0/21, + 95.167.2.4/30, + 95.167.4.168/29, + 95.167.5.64/27, + 95.167.21.104/29, + 95.167.29.104/29, + 95.167.54.76/30, + 95.167.59.244/30, + 95.167.64.20/30, + 95.167.68.216/29, + 95.167.69.116/30, + 95.167.70.32/28, + 95.167.70.136/29, + 95.167.70.176/28, + 95.167.72.48/30, + 95.167.72.140/30, + 95.167.72.204/30, + 95.167.74.136/29, + 95.167.74.180/30, + 95.167.76.160/27, + 95.167.99.48/28, + 95.167.113.48/30, + 95.167.114.48/30, + 95.167.121.68/30, + 95.167.122.128/28, + 95.167.142.32/30, + 95.167.157.156/30, + 95.167.162.76/30, + 95.167.162.236/30, + 95.167.176.0/23, + 95.167.213.0/24, + 95.173.128.0/19, + 95.213.0.0/17, + 109.73.4.224/27, + 109.120.180.0/22, + 109.120.188.0/22, + 109.124.66.128/30, + 109.124.66.160/28, + 109.124.71.64/29, + 109.124.78.108/30, + 109.124.80.132/30, + 109.124.83.20/30, + 109.124.87.96/29, + 109.124.89.36/30, + 109.124.89.140/30, + 109.124.89.212/30, + 109.124.90.32/30, + 109.124.90.128/30, + 109.124.97.4/30, + 109.124.99.16/30, + 109.124.99.160/28, + 109.124.119.88/29, + 109.204.204.232/29, + 109.207.0.0/20, + 109.232.187.16/29, + 109.248.197.0/24, + 128.140.168.0/21, + 130.49.224.0/19, + 145.255.238.240/28, + 146.185.208.0/22, + 146.185.240.0/22, + 149.62.55.240/30, + 155.212.192.0/20, + 176.109.0.0/21, + 176.112.168.0/21, + 176.116.96.0/20, + 178.16.156.148/30, + 178.17.176.0/20, + 178.20.234.224/29, + 178.22.88.0/21, + 178.49.148.176/29, + 178.237.16.0/20, + 178.237.206.0/24, + 178.237.240.0/20, + 178.248.232.60/32, + 178.248.232.137/32, + 178.248.233.26/32, + 178.248.233.32/32, + 178.248.233.60/32, + 178.248.233.136/32, + 178.248.233.244/31, + 178.248.234.30/32, + 178.248.234.33/32, + 178.248.234.60/32, + 178.248.234.79/32, + 178.248.234.83/32, + 178.248.234.136/32, + 178.248.234.204/32, + 178.248.234.228/32, + 178.248.234.238/32, + 178.248.235.60/32, + 178.248.235.75/32, + 178.248.235.244/32, + 178.248.236.20/32, + 178.248.236.83/32, + 178.248.236.244/32, + 178.248.237.18/32, + 178.248.237.98/32, + 178.248.237.136/32, + 178.248.237.242/32, + 178.248.238.55/32, + 178.248.238.102/32, + 178.248.238.128/31, + 178.248.238.136/32, + 178.248.238.155/32, + 178.248.238.172/32, + 178.248.238.205/32, + 178.248.238.255/32, + 178.248.239.215/32, + 185.5.136.0/22, + 185.6.244.0/22, + 185.7.234.188/30, + 185.16.8.0/22, + 185.16.148.0/22, + 185.16.244.0/22, + 185.29.128.0/22, + 185.32.248.0/22, + 185.65.149.170/32, + 185.86.144.0/22, + 185.100.104.0/22, + 185.130.112.0/22, + 185.131.68.0/22, + 185.149.160.0/22, + 185.168.60.0/22, + 185.179.224.0/22, + 185.180.200.0/22, + 185.183.172.0/22, + 185.187.63.0/24, + 185.224.228.0/22, + 185.226.52.0/22, + 185.241.192.0/22, + 188.93.56.0/21, + 188.128.8.240/30, + 188.128.11.196/30, + 188.128.89.0/30, + 188.128.92.104/30, + 188.128.94.204/30, + 188.128.98.204/30, + 188.128.101.108/30, + 188.128.112.216/29, + 188.128.112.240/29, + 188.128.113.0/28, + 188.128.114.128/28, + 188.128.115.232/29, + 188.128.118.224/27, + 188.128.119.104/30, + 188.128.122.240/30, + 188.247.36.124/30, + 188.247.36.128/28, + 188.247.36.204/30, + 193.33.230.0/23, + 193.47.146.0/24, + 193.203.40.0/22, + 193.232.70.0/24, + 194.8.70.0/23, + 194.8.246.0/23, + 194.67.63.200/30, + 194.84.16.12/30, + 194.140.247.0/24, + 194.150.202.0/23, + 194.165.22.0/23, + 194.186.63.0/24, + 194.186.112.80/28, + 194.190.9.0/24, + 194.215.248.0/24, + 194.226.80.0/20, + 194.226.116.0/22, + 194.226.127.0/24, + 195.3.240.0/22, + 195.16.55.224/27, + 195.42.75.8/29, + 195.54.20.168/29, + 195.54.28.72/30, + 195.54.221.0/24, + 195.58.5.16/29, + 195.58.13.120/30, + 195.58.21.196/30, + 195.58.29.57/32, + 195.58.30.164/30, + 195.58.30.200/29, + 195.80.224.0/24, + 195.98.38.16/28, + 195.98.43.104/29, + 195.98.73.56/29, + 195.98.77.100/30, + 195.128.157.0/24, + 195.131.7.8/29, + 195.131.53.248/29, + 195.131.61.80/29, + 195.131.63.24/29, + 195.144.226.224/28, + 195.144.232.144/30, + 195.144.240.128/28, + 195.149.110.0/24, + 195.151.25.48/29, + 195.162.36.64/28, + 195.170.218.24/29, + 195.170.218.88/29, + 195.182.142.128/26, + 195.182.145.64/28, + 195.182.151.212/30, + 195.182.151.216/30, + 195.182.155.164/30, + 195.182.156.96/30, + 195.209.120.0/22, + 195.211.20.0/22, + 195.218.175.40/29, + 195.218.190.0/23, + 195.226.203.0/24, + 195.239.80.32/29, + 195.239.113.0/24, + 195.239.247.0/24, + 212.13.104.116/30, + 212.13.113.100/30, + 212.15.105.64/28, + 212.15.114.156/30, + 212.15.115.80/28, + 212.17.8.176/29, + 212.17.9.144/28, + 212.17.16.192/27, + 212.17.17.176/28, + 212.23.85.48/30, + 212.23.85.56/29, + 212.32.198.64/29, + 212.48.34.176/28, + 212.48.53.76/30, + 212.48.53.84/30, + 212.48.53.88/29, + 212.48.53.100/30, + 212.48.53.144/30, + 212.48.53.152/29, + 212.48.53.160/29, + 212.48.53.184/29, + 212.48.53.192/29, + 212.48.53.200/30, + 212.48.53.216/30, + 212.48.53.236/30, + 212.48.53.240/28, + 212.48.54.0/30, + 212.48.54.8/29, + 212.48.54.16/28, + 212.48.54.32/29, + 212.48.54.44/30, + 212.48.54.48/28, + 212.48.54.64/28, + 212.48.54.80/29, + 212.48.54.92/30, + 212.48.54.96/27, + 212.48.54.128/27, + 212.48.54.164/30, + 212.48.54.168/29, + 212.48.54.176/28, + 212.48.54.196/30, + 212.48.54.200/30, + 212.48.54.208/28, + 212.48.54.240/28, + 212.48.134.192/26, + 212.48.138.240/28, + 212.48.141.160/27, + 212.49.107.224/27, + 212.49.124.0/26, + 212.57.133.0/24, + 212.57.159.0/24, + 212.59.98.48/29, + 212.59.99.96/27, + 212.111.84.0/22, + 212.119.174.0/23, + 212.120.169.48/29, + 212.120.174.88/29, + 212.120.184.48/28, + 212.120.184.64/29, + 212.120.189.208/29, + 212.120.189.224/29, + 212.120.190.112/29, + 212.120.190.240/29, + 212.120.191.120/29, + 212.120.191.248/29, + 212.192.156.0/22, + 212.233.72.0/21, + 212.233.88.0/21, + 212.233.96.0/22, + 212.233.120.0/22, + 213.24.34.0/24, + 213.24.75.0/24, + 213.24.76.0/23, + 213.24.128.0/22, + 213.24.143.0/24, + 213.24.152.0/22, + 213.24.160.0/28, + 213.33.171.240/29, + 213.59.59.16/29, + 213.59.59.64/29, + 213.59.59.120/29, + 213.59.59.128/29, + 213.59.59.144/29, + 213.59.59.168/29, + 213.59.91.48/29, + 213.59.91.128/27, + 213.59.91.176/28, + 213.85.2.64/28, + 213.85.2.80/29, + 213.85.20.8/30, + 213.85.20.32/30, + 213.85.20.84/30, + 213.85.77.64/27, + 213.85.142.176/28, + 213.147.55.108/30, + 213.172.4.192/26, + 213.172.17.252/30, + 213.172.18.60/30, + 213.172.18.124/30, + 213.172.18.148/30, + 213.172.18.160/29, + 213.172.18.252/30, + 213.172.27.0/30, + 213.172.27.116/30, + 213.172.27.160/30, + 213.172.27.204/30, + 213.172.27.212/30, + 213.172.27.224/30, + 213.172.27.252/30, + 213.172.30.136/30, + 213.176.232.0/22, + 213.177.111.0/24, + 213.183.253.56/29, + 213.219.212.0/22, + 213.219.237.68/30, + 213.234.8.8/30, + 213.234.13.60/30, + 213.234.15.228/30, + 213.234.15.248/30, + 213.234.18.52/30, + 213.242.204.76/30, + 213.242.204.236/30, + 213.242.205.88/30, + 213.242.215.68/30, + 213.242.215.192/29, + 213.243.84.80/28, + 213.243.106.48/28, + 213.243.116.0/24, + 217.16.16.0/20, + 217.20.86.128/26, + 217.20.86.232/29, + 217.20.144.0/20, + 217.23.88.168/29, + 217.23.88.248/29, + 217.27.142.176/30, + 217.65.214.24/29, + 217.65.219.160/29, + 217.67.177.208/29, + 217.69.128.0/20, + 217.106.0.0/16, + 217.107.5.8/29, + 217.107.5.16/28, + 217.107.5.40/29, + 217.107.5.80/28, + 217.107.5.96/29, + 217.107.5.112/29, + 217.107.200.0/21, + 217.147.23.112/28, + 217.148.216.156/30, + 217.148.220.160/29, + 217.172.18.0/23, + 217.174.188.0/22, + 217.195.92.16/28, + 217.195.93.144/29, + 217.195.94.200/29 + } + } + + set blacklist_v6 { + type ipv6_addr + flags interval + elements = { + 2a00:1148::/29, + 2a00:46e0::/32, + 2a00:a300::/32, + 2a00:b4c0::/32, + 2a00:bdc0::/33, + 2a00:bdc0:8000::/34, + 2a00:bdc0:c000::/35, + 2a00:bdc0:e002::/47, + 2a00:bdc0:e004::/47, + 2a00:bdc0:e007::/48, + 2a00:bdc0:f000::/36, + 2a00:bdc1::/32, + 2a00:bdc2::/31, + 2a00:bdc4::/30, + 2a14:25c0::/32, + 2a14:25c5::/32, + 2a14:25c6::/31 + } + } + + chain input { + type filter hook input priority 0; + policy accept; + + ct state { established, related } accept + + ip saddr @blacklist_v4 counter drop + ip6 saddr @blacklist_v6 counter drop + } +} \ No newline at end of file diff --git a/blacklists_updater_nftables.sh b/blacklists_updater_nftables.sh new file mode 100755 index 0000000..1fa152f --- /dev/null +++ b/blacklists_updater_nftables.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Generates nftables blacklist configurations from the main blacklist + +set -e + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +INPUT_FILE="$SCRIPT_DIR/blacklists/blacklist.txt" +OUTPUT_DIR="$SCRIPT_DIR/blacklists_nftables" + +# Create output directory if it doesn't exist +mkdir -p "$OUTPUT_DIR" + +echo "Generating nftables blacklists..." + +# Generate mixed IPv4/IPv6 blacklist +python3 "$SCRIPT_DIR/generate_nft_blacklist.py" \ + "$INPUT_FILE" \ + "$OUTPUT_DIR/blacklist.nft" + +# Generate IPv4-only blacklist +grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' "$INPUT_FILE" > /tmp/blacklist-v4.txt || true +python3 "$SCRIPT_DIR/generate_nft_blacklist.py" \ + /tmp/blacklist-v4.txt \ + "$OUTPUT_DIR/blacklist-v4.nft" + +# Generate IPv6-only blacklist +grep -E '^[0-9a-fA-F:]+:' "$INPUT_FILE" > /tmp/blacklist-v6.txt || true +python3 "$SCRIPT_DIR/generate_nft_blacklist.py" \ + /tmp/blacklist-v6.txt \ + "$OUTPUT_DIR/blacklist-v6.nft" + +# Clean up temp files +rm -f /tmp/blacklist-v4.txt /tmp/blacklist-v6.txt + +echo "nftables blacklists generated successfully!" diff --git a/check_nft_blacklist.py b/check_nft_blacklist.py new file mode 100755 index 0000000..9cb5908 --- /dev/null +++ b/check_nft_blacklist.py @@ -0,0 +1,113 @@ +#!/usr/bin/env python3 +""" +check_nft_blacklist.py +Checks if an IP address is in the nftables blacklist configuration. +Usage: + check_nft_blacklist.py nft_bl.conf 192.168.1.1 + check_nft_blacklist.py nft_bl.conf 2001:db8::1 +""" + +import sys +import re +from ipaddress import ip_address, ip_network, AddressValueError +from pathlib import Path + +def parse_nft_config(config_path): + """Extract IPv4 and IPv6 prefixes from nftables config.""" + p = Path(config_path) + if not p.exists(): + raise FileNotFoundError(f"Config file not found: {config_path}") + + content = p.read_text(encoding="utf-8") + v4_prefixes = [] + v6_prefixes = [] + + # Parse IPv4 set (blacklist_v4) + v4_match = re.search( + r'set blacklist_v4\s*\{[^}]*elements\s*=\s*\{([^}]+)\}', + content, + re.DOTALL + ) + if v4_match: + elements = v4_match.group(1) + # Extract all CIDR notations + for match in re.finditer(r'(\d+\.\d+\.\d+\.\d+(?:/\d+)?)', elements): + try: + v4_prefixes.append(ip_network(match.group(1), strict=False)) + except Exception as e: + print(f"Warning: Could not parse IPv4 prefix '{match.group(1)}': {e}", file=sys.stderr) + + # Parse IPv6 set (blacklist_v6) + v6_match = re.search( + r'set blacklist_v6\s*\{[^}]*elements\s*=\s*\{([^}]+)\}', + content, + re.DOTALL + ) + if v6_match: + elements = v6_match.group(1) + # Extract all IPv6 CIDR notations + for match in re.finditer(r'([0-9a-fA-F:]+(?:/\d+)?)', elements): + try: + v6_prefixes.append(ip_network(match.group(1), strict=False)) + except Exception as e: + # Skip false matches from comments or other text + pass + + return v4_prefixes, v6_prefixes + +def check_ip_in_blacklist(ip_addr, v4_prefixes, v6_prefixes): + """Check if IP address is in any of the blacklist prefixes.""" + try: + addr = ip_address(ip_addr) + except AddressValueError as e: + raise ValueError(f"Invalid IP address: {ip_addr} ({e})") + + prefixes = v4_prefixes if addr.version == 4 else v6_prefixes + + for prefix in prefixes: + if addr in prefix: + return True, prefix + + return False, None + +def main(argv): + if len(argv) < 3: + print("Usage: python3 check_nft_blacklist.py ") + print("Examples:") + print(" check_nft_blacklist.py nft_bl.conf 192.168.1.1") + print(" check_nft_blacklist.py nft_bl.conf 2001:db8::1") + return 2 + + config_file = argv[1] + ip_to_check = argv[2] + + # Parse the nftables config + try: + print(f"Loading blacklist from: {config_file}") + v4_prefixes, v6_prefixes = parse_nft_config(config_file) + print(f"Loaded {len(v4_prefixes)} IPv4 prefixes and {len(v6_prefixes)} IPv6 prefixes") + except Exception as e: + print(f"ERROR: Could not parse config file: {e}", file=sys.stderr) + return 3 + + # Check if IP is in blacklist + try: + is_blocked, matching_prefix = check_ip_in_blacklist(ip_to_check, v4_prefixes, v6_prefixes) + + print(f"\nChecking IP: {ip_to_check}") + print("-" * 50) + + if is_blocked: + print(f"✗ BLOCKED - IP is in blacklist") + print(f" Matching prefix: {matching_prefix}") + return 1 + else: + print(f"✓ OK - IP is NOT in blacklist") + return 0 + + except ValueError as e: + print(f"ERROR: {e}", file=sys.stderr) + return 4 + +if __name__ == "__main__": + sys.exit(main(sys.argv)) diff --git a/generate_nft_blacklist.py b/generate_nft_blacklist.py new file mode 100755 index 0000000..01693c0 --- /dev/null +++ b/generate_nft_blacklist.py @@ -0,0 +1,155 @@ +#!/usr/bin/env python3 +""" +generate_nft_blacklist.py +Reads prefixes from a file or stdin, aggregates them and writes nftables config. +Uses named sets for efficient blacklist management. +Usage: + git clone https://github.com/C24Be/AS_Network_List.git + generate_nft_blacklist.py ./AS_Network_List/blacklists/blacklist.txt nft_bl.conf + cp nft_bl.conf /etc/nftables.d/ + systemctl restart nftables +""" + +import sys +from ipaddress import ip_network, collapse_addresses +from pathlib import Path +from datetime import datetime + +def read_lines(path_or_dash): + if path_or_dash == "-": + print("Reading prefixes from STDIN...") + return [ln.rstrip("\n") for ln in sys.stdin] + p = Path(path_or_dash) + if not p.exists(): + raise FileNotFoundError(f"Input file not found: {path_or_dash}") + text = p.read_text(encoding="utf-8") + return text.splitlines() + +def aggregate_prefixes(lines): + v4, v6, invalid = [], [], [] + for lineno, ln in enumerate(lines, start=1): + s = ln.strip() + if not s or s.startswith("#"): + continue + try: + net = ip_network(s, strict=False) + if net.version == 4: + v4.append(net) + else: + v6.append(net) + except Exception as e: + invalid.append((lineno, s, str(e))) + agg_v4 = list(collapse_addresses(sorted(v4, key=lambda x: (int(x.network_address), x.prefixlen)))) + agg_v6 = list(collapse_addresses(sorted(v6, key=lambda x: (int(x.network_address), x.prefixlen)))) + return agg_v4, agg_v6, invalid + +def make_nft_config(agg_v4, agg_v6, comment=None): + lines = [] + lines.append("# Autogenerated nftables blacklist") + lines.append(f"# Generated: {datetime.utcnow().isoformat()}Z") + if comment: + lines.append(f"# {comment}") + lines.append(f"# IPv4: {len(agg_v4)}, IPv6: {len(agg_v6)}") + lines.append("") + lines.append("table inet filter {") + lines.append("") + + # Define IPv4 blacklist set + lines.append(" set blacklist_v4 {") + lines.append(" type ipv4_addr") + lines.append(" flags interval") + if agg_v4: + lines.append(" elements = {") + for i, net in enumerate(agg_v4): + comma = "," if i < len(agg_v4) - 1 else "" + lines.append(f" {net.with_prefixlen}{comma}") + lines.append(" }") + lines.append(" }") + lines.append("") + + # Define IPv6 blacklist set + lines.append(" set blacklist_v6 {") + lines.append(" type ipv6_addr") + lines.append(" flags interval") + if agg_v6: + lines.append(" elements = {") + for i, net in enumerate(agg_v6): + comma = "," if i < len(agg_v6) - 1 else "" + lines.append(f" {net.with_prefixlen}{comma}") + lines.append(" }") + lines.append(" }") + lines.append("") + + # Define input chain with set lookups + lines.append(" chain input {") + lines.append(" type filter hook input priority 0;") + lines.append(" policy accept;") + lines.append("") + lines.append(" ct state { established, related } accept") + lines.append("") + if agg_v4: + lines.append(" ip saddr @blacklist_v4 counter drop") + if agg_v6: + lines.append(" ip6 saddr @blacklist_v6 counter drop") + lines.append(" }") + lines.append("}") + return "\n".join(lines) + +def write_output(outpath, content): + if outpath == "-": + print(content) + return + p = Path(outpath) + p.write_text(content, encoding="utf-8") + p.chmod(0o644) + print(f"Wrote nft config to: {p} (size: {p.stat().st_size} bytes)") + +def main(argv): + if len(argv) < 3: + print("Usage: python3 generate_nft_blacklist.py input.txt output.conf") + print("Use '-' as input or output to mean STDIN/STDOUT respectively.") + return 2 + + infile, outfile = argv[1], argv[2] + try: + lines = read_lines(infile) + except Exception as e: + print(f"ERROR reading input: {e}", file=sys.stderr) + return 3 + + if not any(line.strip() and not line.strip().startswith("#") for line in lines): + print("WARNING: input contains no prefixes (empty or only comments). Nothing to aggregate.") + nft_conf = make_nft_config([], [], comment="Empty input produced no prefixes") + write_output(outfile, nft_conf) + return 0 + + agg_v4, agg_v6, invalid = aggregate_prefixes(lines) + + if invalid: + print("Some lines could not be parsed (line, text, error):") + for ln, txt, err in invalid: + print(f" {ln}: '{txt}' --> {err}", file=sys.stderr) + + print(f"Aggregated IPv4 prefixes: {len(agg_v4)}") + for n in agg_v4: + print(" v4:", n) + print(f"Aggregated IPv6 prefixes: {len(agg_v6)}") + for n in agg_v6: + print(" v6:", n) + + nft_conf = make_nft_config(agg_v4, agg_v6, comment=f"Source: {infile}") + try: + write_output(outfile, nft_conf) + except Exception as e: + print(f"ERROR writing output: {e}", file=sys.stderr) + return 4 + + print("Done.") + print("Load with: sudo nft -f ") + print("View counters: sudo nft list chain inet filter input -a") + print("View sets: sudo nft list set inet filter blacklist_v4") + print(" sudo nft list set inet filter blacklist_v6") + return 0 + +if __name__ == "__main__": + sys.exit(main(sys.argv))