Script I originally posted on IPInfoDB to block country based on IP address geolocation using iptables.

I will show you howto install PSAD to block DDOS attacks (distributed denial of service) and port scan on a webserver. Here I will use Ubuntu 8.04 LTS server but it should be very similar on other distro.

PSAD scan iptables log file to generate the attack block. The problem is that when you log ALL packets as shown in other PSAD tutorials, it will slow down considerably your server if it's busy and generate huge huge log files (growing at a rate of 1meg per second or more). With simple iptables rules, we will only log traffic that look suspicious (5 new connections in 5 seconds for example).

I will show you howto install PSAD on Ubuntu 8.04 LTS server to block DDOS attacks (distributed denial of service) and port scan.

PSAD scan iptables log file to generate the attack block. The problem is that when you log ALL packets as shown in other PSAD tutorials, it will slow down considerably your server if it's busy and generate huge huge log files (growing at a rate of 1meg per second or more). With simple iptables rules, we will only log traffic that look suspicious (5 new connection in 5 second for example).

In this howto, I will show you how to automatically create iptables rules to block all connection from one country or more. The blocklist is created with an API I wrote and you can use wget to update the blocklist monthly.

Updated howto available here : http://blogama.org/node/98