nft-blackhole

Script / daemon to blocking IP in nftables by country and black lists.

Table of contents

• Overview
• Installation
  • Arch Linux Users
  • Manual
• Configuration
  • Set the configuration in a file
• Usage
  • Manual
  • With systemd
  • List counter packages dropped/accept
  • List table and sets for blackhole
  • Refresh lists
• Credits
• License

Overview

Features

• download publicly available blacklists and block IPs from them,
• block or whitelist individual countries,
• whitelist individual networks or IP addresses,

Configuration file

In the configuration file you can define:

• IP versions supported (ipv4, ipv6),
• blocking policy (reject, drop,)
• network or IP addresses for the white list,
• blacklist url addresses,
• list of countries,
• policy for countries (accept, block)

Installation

Arch Linux Users

Install from AUR package nft-blackhole

For example:

yay -S nft-blackhole
pikaur -S nft-blackhole

Manual

Requirements

• nftables
• python 3.6+
• python-yaml
• systemd (for daemon)

File location

/usr/bin/nft-blackhole.py
/usr/share/nft-blackhole/nft-blackhole.template
/etc/nft-blackhole.conf
/usr/lib/systemd/system/nft-blackhole.service

Configuration

Set the configuration in a file

/etc/nft-blackhole.conf

Usage

Manual

As root:

/usr/bin/nft-blackhole.py start
/usr/bin/nft-blackhole.py reload
/usr/bin/nft-blackhole.py restart
/usr/bin/nft-blackhole.py stop

With systemd

As root:

systemctl enable nft-blackhole.service
systemctl start nft-blackhole.service
systemctl reload nft-blackhole.service
systemctl restart nft-blackhole.service

List counter packages dropped/accept

nft list chain inet blackhole input

List table and sets for blackhole

nft list table inet blackhole

Refresh lists

/usr/bin/nft-blackhole.py reload
systemctl reload nft-blackhole.service

or add to root crontab e.g.

0 */6 * * * systemctl reload nft-blackhole.service

Credits

country-ip-blocks - CIDR country-level IP lists,

https://iplists.firehol.org/ - aggregated, publicly available blacklists

License

Code released under MIT license.