3

I am trying to block a range of IP address on my Ubuntu 16.04LTS server from a specific country, i.e. China, Iran, etc.

I was hoping to find a script or something I could run to easily make a dynamically updating list. As in I just put in country codes and it auto populates the current list from somewhere then appended my block range. Making it easy to updates for the list of address as they change. But to start with I used country ip blocks to find a list of addresses for China and saved them to a text file titled "chinaiprange.txt"

After some searching I found the following command to enter them all in at once from this example

while read line; do sudo ufw insert 1 deny from $line to any; done < chinaiprange.txt

However when I run it I recieve the following output:ERROR: Bad source address

The addresses are saved in the following format:

1.0.1.0/24 
1.0.2.0/23
1.0.8.0/21
...

If there is a better way to do this that would be great but letting me know what I am doing wrong would be just as awesome. Thanks in advance!

  • Are you sure the chinaiprange.txt file was not saved with Windows-style line (CR-LF) endings? – steeldriver Jun 10 '16 at 2:41
  • @steeldriver I am not sure... When I open the file in nano it does say "converted from DOS format". Is this what you are referring to? If so how do I change it? – mrhatter Jun 11 '16 at 2:15
  • That does indeed indicate Windows (DOS) line endings: you can convert the file using dos2unix, or by opening it in vi instead of nano and then executing :set ff=unix followed by :wq to re-save, or for example using sed -i 's/\r$//' chinaiprange.txt. After that, I expect your original command should work. – steeldriver Jun 11 '16 at 2:27
  • @steeldriver Thank you! That appears to be working for me now! It will probably take awhile to run but I will close this out once I can confirm the rules have been added. – mrhatter Jun 11 '16 at 2:40
  • The solution was to change the file format. A big thanks to @steeldriver for finding the solution! – mrhatter Jun 11 '16 at 5:03
0

Re-read man ufw. There are two, similar, ufw invocations that you're confusing:

   ufw [--dry-run] [delete] [insert NUM] allow|deny|reject|limit [in|out] [log|log-all] PORT[/PROTOCOL]

   ufw [--dry-run] [rule] [delete] [insert NUM] allow|deny|reject|limit [in|out [on INTERFACE]] [log|log-all] [proto PROTOCOL] [from ADDRESS [port PORT]] [to ADDRESS [port PORT]]

You probably want to

sudo ufw insert 1 deny on eth0 from $line 
| improve this answer | |
  • I tried that and now I get the following message 'ERROR: Invalid token 'on'' – mrhatter Jun 10 '16 at 2:40
  • AFAIK he nested usage syntax [foo|bar [baz]] indicates that baz is an optional parameter of foo or bar. So in this case deny in or deny out (implying all interfaces) or deny in on eth0, deny out on eth0 (a specific interface) are legal - but deny on eth0 without specifying one of in or out are not – steeldriver Jun 10 '16 at 4:08
  • I have tried the change of adding "in" to the command but it now gives me the same "bad address error" I am thinking @steeldriver is correct in that I have the wrong file format for it to be read. I created the text file on a Windows machine. – mrhatter Jun 11 '16 at 2:17
1

I don't think there's anything wrong with the syntax of your command (either of the ufw command itself, or the bash loop - although it would be good practice to quote the $line variable i.e. ... from "$line" to any ...).

The ERROR: Bad source address error indicates a problem with the address string itself, and we can guess that it might be due to DOS-style CR-LF line endings - which you were able to confirm by opening the chinaiprange.txt file in nano

The solution is to fix the line endings, using any of the well known methods such as:

  • running your file through the dos2unix command
  • using tr or sed - for example sed -i 's/\r$//' chinaiprange.txt
  • opening the file in vi and executing :set ff=unix followed by :wq to re-save
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.