Take a look on ipset. You can easily block whole countries or custom IP ranges.
I'm not sure about Asuswrt-Merlin, but you can try iptables rules like
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j BRUTE
...
-A BRUTE -m recent --update --seconds 600 --hitcount 5 --name BRUTE --rsource -j DROP
-A BRUTE -m recent --set --name BRUTE --rsource -j ACCEPTadmin@censored:/tmp/home/root# cat /jffs/scripts/firewall-start
#!/bin/sh
iptables -I INPUT 6 -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -I INPUT 7 -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 6 --rttl --name SSH -j DROP
admin@censored:/tmp/home/root#mkdir -p /jffs/scripts/
touch /jffs/scripts/firewall-start
chmod 755 /jffs/scripts/firewall-startvi /jffs/scripts/firewall-start#!/bin/sh
iptables -I INPUT 6 -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -I INPUT 7 -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 6 --rttl --name SSH -j DROPiptables -L -v --line-numbers
#!/bin/sh
# FIRST, LET'S MAKE SURE THAT OUTBOUND TRAFFIC IS LOGGED FOR OUR SPLUNK REPORTING SERVER:
iptables -I INPUT -i br0 -j logaccept
#
# NOW, LET'S MAKE SURE THAT OUR CUSTOM RULES GET LOADED INTO IPTABLES FIRST:
/jffs/firewall/fw_auto_customblock.fw
/jffs/firewall/fw_auto_anomalyblock.fw
#
#
# LET'S CREATE OUR IPSET LIST(S).
# FIRST, WE NEED TO PREPARE THE IPSET MODULE:
lsmod | grep "ipt_set" > /dev/null 2>&1 || \
for module in ip_set ip_set_nethash ip_set_iphash ipt_set
do
insmod $module
done
#
# NOW LET'S PREPARE THE DIRECTORY WHERE WE WANT TO SAVE OUR IPSET NETWORK LIST(S):
IPSET_LISTS_DIR=/jffs/ipset_lists
[ -d "$IPSET_LISTS_DIR" ] || mkdir -p $IPSET_LISTS_DIR
#
#
#
# IT WAS RECOMMENDED TO BLOCK STEALTHY TOR NODES (MAY REMOVE LATER, AS I MAY WISH TO USE TOR MYSELF):
if [ "$(ipset --swap list_tornodes list_tornodes 2>&1 | grep 'Unknown set')" != "" ]
then
ipset -N list_tornodes iphash
[ -e $IPSET_LISTS_DIR/tor.lst ] || wget -q -O $IPSET_LISTS_DIR/tor.lst http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv
for IP in $(cat $IPSET_LISTS_DIR/tor.lst)
do
ipset -A list_tornodes $IP
done
fi
[ -z "$(iptables-save | grep list_tornodes)" ] && iptables -I INPUT -m set --set list_tornodes src -j DROP
#
#
#
# NOW FOR THE FUN PART; LET'S BLOCK COUNTRIES THAT SEND US THE MOST "SCRIPTY" PROBES, OR COUNTIES THAT WE FEEL ARE "SUSPICIOUS" IN NATURE:
# (See other countries code at http://www.ipdeny.com/ipblocks/)
# (or https://www.countryipblocks.net/country_selection.php)
# EDIT COUNTRY ZONES WITH SPACES ONLY BELOW (1 OF 2):
for country in af br cl cn de fr hk hu il iq ir it kp kr pk ro ru sa tr tw
do
if [ "$(ipset --swap list_$country list_$country 2>&1 | grep 'Unknown set')" != "" ]
then
ipset -N list_$country nethash
fi
done
#
# EDIT COUNTRY ZONES WITH SPACES ONLY BELOW (2 OF 2):
for country in af br cl cn de fr hk hu il iq ir it kp kr pk ro ru sa tr tw
do
[ -e $IPSET_LISTS_DIR/$country.lst ] || wget -q -O $IPSET_LISTS_DIR/$country.lst http://www.ipdeny.com/ipblocks/data/countries/$country.zone
for IP in $(cat $IPSET_LISTS_DIR/$country.lst)
do
ipset -A list_$country $IP
[ -z "$(iptables-save | grep list_$country)" ] && iptables -I INPUT -m set --set list_$country src -j DROP
done
done
#
#
# AND IF THIS DOESN'T WORK, LET'S HAVE A FALLBACK SCRIPT PREPARED AS A PRECAUTION:
#/jffs/firewall/fw_auto_countryblock.fw#######@RT-AC66R:/tmp/home/root# iptables -nL | grep list_
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_tw src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_tr src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_sa src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_ro src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_pk src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_kr src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_kp src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_ir src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_iq src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_il src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_hu src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_hk src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_de src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_cn src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_cl src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_br src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_af src
DROP all -- 0.0.0.0/0 0.0.0.0/0 set list_tornodes src
#######@RT-AC66R:/tmp/home/root# ipset -L | grep Name
Name: list_tornodes
Name: list_af
Name: list_br
Name: list_cl
Name: list_cn
Name: list_de
Name: list_fr
Name: list_hk
Name: list_hu
Name: list_il
Name: list_iq
Name: list_ir
Name: list_it
Name: list_kp
Name: list_kr
Name: list_pk
Name: list_ro
Name: list_ru
Name: list_sa
Name: list_tr
Name: list_tw
#######@RT-AC66R:/tmp/home/root# ipset -L list_cn | grep 101.102.64.
101.102.64.0/19
#######@RT-AC66R:/tmp/home/root#
# Block incoming traffic from some countries. cn and pk is for China and Pakistan. See other countries code at http://www.ipdeny.com/ipblocks/
if [ "$(ipset --swap BlockedCountries BlockedCountries 2>&1 | grep 'Unknown set')" != "" ]
then
ipset -N BlockedCountries nethash
for country in af al br bg cl cn de dk fr fi gb hk hu il iq ir it jp kp kr pk ro ru sa se ua tr tw
do
[ -e $IPSET_LISTS_DIR/$country.lst ] || wget -q -O $IPSET_LISTS_DIR/$country.lst http://www.ipdeny.com/ipblocks/data/countries/$country.zone
for IP in $(cat $IPSET_LISTS_DIR/$country.lst)
do
ipset -A BlockedCountries $IP
done
done
fi
[ -z "$(iptables-save | grep BlockedCountries)" ] && iptables -I INPUT -m set --set BlockedCountries src -j DROP
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!