站点防攻击之禁止国外ip

一 获取国内ip地址

wget -q --timeout=60 -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F| '/CN|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /root/china_ssr.txt

2020-6-28最新的ip列表

链接：https://pan.baidu.com/s/1428CL-I7XPl8PeAzhi4Jog
提取码：c0fp

二、防火墙添加ip列表

centos6下 allcn.sh

mmode=$1

下面语句可以单独执行，不需要每次执行都获取网段表

wget -q --timeout=60 -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F| '/CN|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /root/china_ssr.txt

CNIP="/root/china_ssr.txt"
#获取ip列表
gen_iplist() {
cat <<-EOF
$(cat ${CNIP:=/dev/null} 2>/dev/null)
EOF
}
#清空
flush_r() {
iptables -F ALLCNRULE 2>/dev/null
iptables -D INPUT -p tcp -j ALLCNRULE 2>/dev/null
iptables -X ALLCNRULE 2>/dev/null
ipset -X allcn 2>/dev/null
}

mstart() {
ipset create allcn hash:net 2>/dev/null
ipset -! -R <<-EOF
$(gen_iplist | sed -e "s/^/add allcn /")
EOF

iptables -N ALLCNRULE
iptables -I INPUT -p tcp -j ALLCNRULE
iptables -A ALLCNRULE -s 127.0.0.0/8 -j RETURN
iptables -A ALLCNRULE -s 169.254.0.0/16 -j RETURN
iptables -A ALLCNRULE -s 224.0.0.0/4 -j RETURN
iptables -A ALLCNRULE -s 255.255.255.255 -j RETURN
#start可在此增加你的公网网段，避免调试ipset时出现自己无法访问的情况

end

iptables -A ALLCNRULE -m set --match-set allcn src -j RETURN
iptables -A ALLCNRULE -p tcp -j DROP
}

if [ "$mmode" == "stop" ] ;then
flush_r
exit 0
fi

flush_r
sleep 1
mstart

centos7下 allcn.sh

三、nginx添加ip白名单

location /{
include /home/whitelist.conf;
deny all;
}

whitelist.conf 内容

allow 117.124.0.0/9;
allow 116.128.0.0/9;
allow 39.128.0.0/10;
...
#当然，whitelist.conf 中的内容也可以直接写在 nginx.conf 里

四、程序中添加限制,接口响应影响访问速度

php是否国内ip

function isIpAllow() {
$ip = "";
if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = trim(current(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])));
} elseif(!empty($_SERVER['REMOTE_ADDR']) ) {
$ip = $_SERVER['REMOTE_ADDR'];
}
$ip = preg_match ( '/[\d.]{7,15}/', $ip, $matches ) ? $matches [0] : '';
if($ip)
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://ip-api.com/json/".$ip."?fields=country");
curl_setopt($ch, CURLOPT_TIMEOUT, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$data = curl_exec($ch);
curl_close($ch);
if( !empty($data) && strpos( strtolower($data),'china')=== false)
{
return false;
}
return true;
}
return true;
}

ip的参考文章

https://www.cnblogs.com/lushaoyan/p/11088213.html
https://www.cnblogs.com/rendd/p/6183094.html