I followed a tutorial online on how to block traffic from other countries to my server through UFW rules. I downloaded the CIDR file for IPs from this website https://www.ip2location.com/free/visitor-blocker, it allows to download IPs of 30 countries at once and I did prepared many files for all countries except my country then I opened Tmux session in my terminal through ssh and then I inserted this code and I started a task that won't finish since 2 days.

cat cidr-30countries_01.txt | awk '/^[^#]/ { print $1 }' | sudo xargs -I {} ufw deny from {} to any && cat cidr-30countries_02.txt | awk '/^[^#]/ { print $1 }' | sudo xargs -I {} ufw deny from {} to any && cat cidr-30countries_03.txt | awk '/^[^#]/ { print $1 }' | sudo xargs -I {} ufw deny from {} to any && cat cidr-30countries_04.txt | awk '/^[^#]/ { print $1 }' | sudo xargs -I {} ufw deny from {} to any && cat cidr-30countries_05.txt | awk '/^[^#]/ { print $1 }' | sudo xargs -I {} ufw deny from {} to any

Since 2 days and every time I ssh to my server on cloud to check tmux session I find the task won't end and still adding rules.

Is something wrong?

Please help!!

Thank you in advance

  • 1
    There are literally tens of 1000s of CIDRs that your system has to add and handle. Country blocking on the server level is usually painful and difficult, this is why it's usually not done at the iptables / server level but at the border of the network where a firewall usually sits. It'll take several days at least for your ufw system to catch up and work with the thousands of CIDRs, there's nothing wrong it's just you're trying to block thousands of IP ranges and ufw and such are slower. – Thomas Ward Mar 20 at 17:54
  • The accepted way to do this is via ipset. It is relatively fast, and easier to do updates. I was afraid to try it for a long time, even though people recommended it. I'll see if I can find a good reference for you, but it'll take awhile. I block several countries now. – Doug Smythies Mar 20 at 18:27
  • 1
    see this reference, which seems to be the one I originally used, as I added a couple of comments. You will have to figure out how to use the method with UFW, which is just a front end for iptables. Note: I never use UFW. I also don't update the list via a cron job, but rather just do it whenever I feel like it. – Doug Smythies Mar 20 at 18:41
  • Is this for web traffic? I.e. HTTP port 80 and 443? There are easier ways but wanted to check first. – iangetz Mar 20 at 21:43
  • @ThomasWard Your answer helped me to throw away my confusion. Thank you. – Earth Angle Mar 21 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.