ip-blocklist

ip-blocklist

Fragments for IP-based access control. Use these patterns to restrict or block traffic at the network or proxy layer. Composable with firewall and rate-limiting skills.

iptables — Static Block/Allow

# Block a single IP
iptables -A INPUT -s 203.0.113.42 -j DROP

# Block a CIDR range
iptables -A INPUT -s 198.51.100.0/24 -j DROP

# Allow only specific IPs to a port (allowlist pattern)
iptables -A INPUT -p tcp --dport 5432 -s 10.8.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j DROP           # drop all others

# Log before dropping (for audit trail)
iptables -A INPUT -s 203.0.113.42 -j LOG --log-prefix "BLOCKED-IP: "
iptables -A INPUT -s 203.0.113.42 -j DROP

# Persist
iptables-save > /etc/iptables/rules.v4

nftables — Dynamic Set-Based Blocklist

# /etc/nftables.conf — define a set, populate it dynamically

table inet filter {
  set blocklist {
    type ipv4_addr
    flags interval, timeout      # timeout: entries auto-expire
    timeout 24h                  # auto-remove after 24h
  }

  set allowlist {
    type ipv4_addr
    flags interval
    elements = { 10.8.0.0/24, 203.0.113.0/24 }  # static admin ranges
  }

  chain input {
    type filter hook input priority 0; policy drop;
    ip saddr @blocklist drop
    ip saddr @allowlist accept
    # ... other rules
  }
}

# Add to blocklist at runtime (no reload needed)
nft add element inet filter blocklist { 198.51.100.42 }
nft add element inet filter blocklist { 192.0.2.0/24 }

# Remove from blocklist
nft delete element inet filter blocklist { 198.51.100.42 }

# Inspect current set contents
nft list set inet filter blocklist

nginx — Geo-Based Access Control

# nginx.conf — http block
http {
    # Allowlist: only listed IPs allowed
    geo $allowed_ip {
        default         0;             # deny by default
        10.8.0.0/24     1;             # VPN subnet
        203.0.113.0/24  1;             # office range
        127.0.0.1       1;             # localhost
    }

    # Blocklist: listed IPs denied
    geo $blocked_ip {
        default         0;
        198.51.100.0/24 1;             # known bad range
        192.0.2.42      1;
    }
}

# server block — enforce
server {
    location /admin/ {
        if ($allowed_ip = 0) { return 403; }
        proxy_pass http://127.0.0.1:9002;
    }

    location / {
        if ($blocked_ip = 1) { return 403; }
        proxy_pass http://127.0.0.1:8080;
    }
}