A powerful bash-based tool for managing iptables rules to block IP addresses by country using Regional Internet Registry (RIR) data. IPDroper allows you to easily block entire countries' IP ranges from accessing your Linux system.

Two versions available:

• Traditional iptables version - Standard approach with direct iptables rules
• High-performance ipset version - Advanced approach with significant performance improvements

For Japanese README is here

• Description
• Versions Comparison
• Features
• Prerequisites
• Installation
• Usage
• Scripts Overview
• Directory Structure
• Troubleshooting
• License

IPDroper is a comprehensive bash script suite that simplifies the process of blocking IP addresses by country using iptables on Linux systems. It leverages data from Regional Internet Registries (RIRs) to automatically generate and manage iptables rules for blocking entire country IP ranges.

The tool supports all major RIRs:

• APNIC (Asia Pacific Network Information Centre)
• RIPE-NCC (Réseaux IP Européens Network Coordination Centre)
• ARIN (American Registry for Internet Numbers)
• LACNIC (Latin America and Caribbean Network Information Centre)
• AFRINIC (African Network Information Centre)

1. Hash-table based: Fast lookup even with thousands of IP ranges
2. Memory efficient: Significant memory reduction compared to traditional iptables
3. Single rule: Manage thousands of IP ranges with just one iptables rule
4. Dynamic updates: Update IP lists without reloading rules

• Country-based IP blocking - Block entire countries using ISO 3166-1 alpha-2 country codes
• Multi-RIR support - Works with all major Regional Internet Registries
• Easy management - Simple menu-driven interface for all operations
• Flexible removal - Easily remove country blocks when no longer needed
• Automatic CIDR calculation - Converts IP ranges to CIDR notation automatically
• Validation - Validates country codes and ensures proper iptables chain management
• High-performance ipset option - Advanced version with hash-table based IP management

• Linux operating system
• Bash shell
• iptables installed and configured
• curl for downloading RIR data
• Root/sudo privileges for iptables operations

• Linux operating system (kernel 2.6.39+)
• Bash shell
• ipset installed and configured
• iptables installed and configured
• curl for downloading RIR data
• Root/sudo privileges for ipset and iptables operations

1. Clone the repository:

   git clone https://github.com/yourusername/IPDroper.git
   cd IPDroper

2. Make scripts executable:

   chmod +x setup.sh
   chmod +x scripts/*.sh

3. Run the setup script:

   ./setup.sh

1. Clone the repository:

   git clone https://github.com/yourusername/IPDroper.git
   cd IPDroper

2. Make scripts executable:

   chmod +x *.sh
   chmod +x scripts/*.sh

3. Install ipset (first time only):

   sudo ./install_ipset.sh

4. Start IPDroper:

   sudo ./setup_ipset.sh

1. Run the main setup script:

   sudo ./setup.sh

2. Select an option from the menu:

   • 1 - Add drop script (block a country)
   • 2 - Delete drop chain script (unblock a country)
   • 3 - Show current iptables script (view rules)

1. Run the ipset setup script:

   sudo ./setup_ipset.sh

2. Select an option from the menu:

   • 1 - Add country block using ipset
   • 2 - Remove country block
   • 3 - Show current ipset and iptables rules

1. Select option 1 from the setup menu
2. Choose your Regional Internet Registry (1-5)
3. Enter the country's alpha-2 code (e.g., CN for China, RU for Russia)
4. Confirm the operation

Example:

# Traditional version
sudo ./scripts/iptablesConfiguration.sh
# Select: 1 (APNIC)
# Enter country code: CN

# ipset version
sudo ./setup_ipset.sh
# Select: 1 (Add country block)
# Select RIR: 1 (APNIC)
# Enter country code: CN

1. Select option 2 from the setup menu
2. Enter the country's alpha-2 code
3. The script will automatically remove all related rules

1. Select option 3 from the setup menu
2. View detailed rules and statistics

• setup.sh - Main menu script for traditional iptables operations
• scripts/iptablesConfiguration.sh - Add country blocks with direct iptables rules
• scripts/iptablesRemove.sh - Remove country blocks
• scripts/iptablesList.sh - View current iptables rules

• setup_ipset.sh - Main menu script for ipset operations
• install_ipset.sh - Install and configure ipset
• scripts/iptablesConfiguration.sh - Add country blocks using ipset
• scripts/iptablesRemove.sh - Remove country blocks
• scripts/iptablesList.sh - View current ipset and iptables rules

IPDroper/
├── README.md                 # This file
├── setup.sh                  # Traditional version main menu
├── setup_ipset.sh            # ipset version main menu
├── install_ipset.sh          # ipset installation script
├── README_ipset.md           # Detailed ipset version documentation
└── scripts/
    ├── iptablesConfiguration.sh  # Add country blocks
    ├── iptablesRemove.sh         # Remove country blocks
    └── iptablesList.sh           # View current rules

1. Permission Denied

# Ensure you have sudo privileges
sudo ./setup.sh
# or for ipset version
sudo ./setup_ipset.sh

2. iptables not found

# Install iptables (Ubuntu/Debian)
sudo apt-get install iptables

# Install iptables (CentOS/RHEL)
sudo yum install iptables

3. ipset not found (for ipset version)

# Run the installation script
sudo ./install_ipset.sh

4. curl not found

# Install curl (Ubuntu/Debian)
sudo apt-get install curl

# Install curl (CentOS/RHEL)
sudo yum install curl

5. Invalid country code

• Ensure you're using valid ISO 3166-1 alpha-2 country codes
• Examples: US, CN, RU, JP, DE

6. Network connectivity issues

• Check your internet connection
• Verify firewall settings allow outbound connections
• Ensure DNS resolution is working

To see detailed output, you can run scripts directly:

# Traditional version
sudo bash -x ./scripts/iptablesConfiguration.sh

# ipset version
sudo bash -x ./setup_ipset.sh

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.

This project is licensed under the MIT License - see the LICENSE file for details.

Warning: This tool modifies iptables rules and can affect network connectivity. Always test in a safe environment first and ensure you have proper backups of your iptables configuration.

Note: IPDroper is designed for educational and security purposes. Please ensure compliance with local laws and regulations when using this tool.