README, nginx, iptables, vk, mail.ru

blacklists_updater_iptables.sh

@@ -0,0 +1,96 @@
+#!/bin/sh
+
+# Input files (generated by blacklists_updater_txt.sh)
+blacklist_file="blacklists/blacklist.txt"
+blacklist_v4_file="blacklists/blacklist-v4.txt"
+blacklist_v6_file="blacklists/blacklist-v6.txt"
+
+# Output directory and files
+iptables_output_dir="blacklists_iptables"
+iptables_output_file="${iptables_output_dir}/blacklist.ipset"
+iptables_v4_output_file="${iptables_output_dir}/blacklist-v4.ipset"
+iptables_v6_output_file="${iptables_output_dir}/blacklist-v6.ipset"
+
+# Create iptables directory if it doesn't exist
+mkdir -p "${iptables_output_dir}"
+
+# Function to generate ipset config from input file
+generate_ipset_config() {
+    local input_file="$1"
+    local output_file="$2"
+    local ip_version="$3"
+    local set_name="$4"
+    local family="$5"
+    
+    # Count entries for hash size calculation
+    local count=$(wc -l < "${input_file}" | tr -d ' ')
+    local hashsize=$((count > 1024 ? count : 1024))
+    local maxelem=$((count * 2))
+    
+    # Generate ipset configuration with header
+    cat > "${output_file}" << EOF
+# IPSet blacklist configuration ${ip_version}
+# Auto-generated from $(basename ${input_file})
+# Last updated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
+#
+# Usage:
+#   1. Load the ipset:
+#      ipset restore < $(basename ${output_file})
+#
+#   2. Use with iptables/ip6tables:
+#      iptables -I INPUT -m set --match-set ${set_name} src -j DROP
+#      iptables -I FORWARD -m set --match-set ${set_name} src -j DROP
+#
+#   3. To flush/delete the set:
+#      ipset flush ${set_name}
+#      ipset destroy ${set_name}
+#
+
+create ${set_name} hash:net family ${family} hashsize ${hashsize} maxelem ${maxelem}
+EOF
+
+    # Add entries for each network/IP
+    while IFS= read -r network; do
+        # Skip empty lines
+        [ -z "${network}" ] && continue
+        echo "add ${set_name} ${network}" >> "${output_file}"
+    done < "${input_file}"
+    
+    echo "✓ Generated ${ip_version}: ${output_file}"
+    echo "  Total entries: ${count}"
+}
+
+# Generate ipset configurations from blacklist files
+generate_ipset_config "${blacklist_v4_file}" "${iptables_v4_output_file}" "(IPv4 only)" "blacklist-v4" "inet"
+generate_ipset_config "${blacklist_v6_file}" "${iptables_v6_output_file}" "(IPv6 only)" "blacklist-v6" "inet6"
+
+# For mixed file, we need to create two sets (IPv4 and IPv6) as ipset doesn't support mixed families
+cat > "${iptables_output_file}" << EOF
+# IPSet blacklist configuration (mixed IPv4/IPv6)
+# Auto-generated from $(basename ${blacklist_file})
+# Last updated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
+#
+# Usage:
+#   1. Load the ipset:
+#      ipset restore < $(basename ${iptables_output_file})
+#
+#   2. Use with iptables/ip6tables:
+#      iptables -I INPUT -m set --match-set blacklist-v4 src -j DROP
+#      iptables -I FORWARD -m set --match-set blacklist-v4 src -j DROP
+#      ip6tables -I INPUT -m set --match-set blacklist-v6 src -j DROP
+#      ip6tables -I FORWARD -m set --match-set blacklist-v6 src -j DROP
+#
+#   3. To flush/delete the sets:
+#      ipset flush blacklist-v4 && ipset destroy blacklist-v4
+#      ipset flush blacklist-v6 && ipset destroy blacklist-v6
+#
+
+EOF
+
+# Append both IPv4 and IPv6 sets to the mixed file
+tail -n +2 "${iptables_v4_output_file}" | grep -E "^(create|add)" >> "${iptables_output_file}"
+echo "" >> "${iptables_output_file}"
+tail -n +2 "${iptables_v6_output_file}" | grep -E "^(create|add)" >> "${iptables_output_file}"
+
+echo "✓ Generated (mixed IPv4/IPv6): ${iptables_output_file}"
+echo "  Total entries: $(wc -l < "${blacklist_file}" | tr -d ' ')"