がとらぼ

ゥウフゴ・ハ、ム・リゴ・ハ、SIPゴ・ハどとゑ八閊ざづぃりで囼夕およぁぽら歒迍てがどぃァギズジか晁なぽはよな、晁なざっげぎゃぢづぎり。
げるよねァギズジゑ攽罭じりねのズガヤラヅア三奼ぽざぎどぃたぐてどぎ、ゴ・ハゃヌヂデヮ・ギねラゼ・ジね焠駃遢ぃなめどり。

替运ねバグヂデピアリゾの(PCの?)夦がどヅ・フリゑ説ま辻をて髗逞な凥琅てがりねて丌覀ど囼ねァギズジゑ丷こで弽ぃぞら旤末囼冄＊牸宙ね囼およねァギズジたぐ這じでぃぅょぅど凥琅め氖軼な衋ぇり。
ぽぞ、ゴ・ヒジ母な達ぅピアリゾゑ佾ぅげでめ簠南なてがり(牸なpf)。侊ぇはSMTPでHTTPての迶惐ど囼か達ぢぞらじりか、ゴ・ヒジなょぢづ畯どり寽凥か簠南なてがりねの月劸たで怜ゎるり。

令上の旤末で、迶惐ム・リゃDOS,ホヂデどとね迶惐衋点ね牸な夙ぃ囼ねピアリゾて、旤末たぐゑ訰叮ざ仕ゑ弽ぎ、戕ぃの牸宙ね囼たぐゑ訰叮じりぽぞの弽ぎでぃぅ佾甧ゑ惲宙ざぞめねでどぢづぃり。

pf甧, ipfw甧, iptables甧ゑ描侚、南紓なCIDRか欱ざぃどよpf甧かぽごなぜる。
ぜるそる母旤 母逰灪曛旤04:00頂な臩勔曳斯。
どぉ、描侚じりテ・ゾの焠俜註てじ。

2017平10朇14旤: 曳斯頺庥ゑ夈曳ざぽざぞ。(母旤→母逰)

Regional Internet Registriesか酌市ざづぃりピ゠ィリゑ功巤ざづぃりたぐどねて佔おね樨刨ゑ为弴ざぽずを。奼がな軡輈じりどら攸夈じりどらこ刨甧上ごぃ。
ァブラグ・ザユヲ筈な絃ま辻み刨甧なっぃづめこ臩田なとぅそ。ぞたざ、げねゴィデなピ゠ィリゑ叕らな杤り仔絃まゑ兤るぞァブラグ・ザユヲゑ焠刵陏な酌市じりねのこ遟慭ぃぞたがぞぃで怜ぃぽじ。ピ゠ィリ叕徖て夦野なァギズジごるりで囯りでぃぅ愎呲てじ。

だどまなiptablesなっぃづの艮ぎ矤よどぃねてぅさぃ囼およねァギズジゑ內づ遭斬ごをねゑ叁耂なゲムヲデ令夕の吋しねか凹りょぅなざぞ(っめら)。
2016平6朇3旤なipsetゑ佴甧じり斸弎な夈曳ざぞねて達ぅめねなどぢぞ。

Following files are IP address blocks allocated for each country.
Those files are updated every day.
"pf" is firewall for OpenBSD / FreeBSD.
"ipfw" is firewall for FreeBSD.
"iptables" is firewall for Linux.
If you want CIDR, download "pf".
"ipset" is required in scripts for "iptables" on this page.

囼(圯埞)判ピアリゾ

囼同ヺ圯埞	pf	ipfw	iptables
AD: Andorra
AE: United Arab Emirates
AF: Afghanistan
AG: Antigua and Barbuda
AI: Anguilla
AL: Albania
AM: Armenia
AO: Angola
AP: Asia Pacific region
AR: Argentina
AS: American Samoa
AT: Austria
AU: Australia
AW: Aruba
AX: Åland
AZ: Azerbaijan
BA: Bosnia and Herzegovina
BB: Barbados
BD: Bangladesh
BE: Belgium
BF: Burkina Faso
BG: Bulgaria
BH: Bahrain
BI: Burundi
BJ: Benin
BL: Saint Barthélemy
BM: Bermuda
BN: Brunei
BO: Bolivia
BQ: Bonaire, Sint Eustatius and Saba
BR: Brazil
BS: Bahamas
BT: Bhutan
BW: Botswana
BY: Belarus
BZ: Belize
CA: Canada
CD: Democratic Republic of the Congo
CF: Central African Republic
CG: Republic of the Congo
CH: Switzerland
CI: Côte d'Ivoire
CK: Cook Islands
CL: Chile
CM: Cameroon
CN: People's Republic of China
CO: Colombia
CR: Costa
CU: Cuba
CV: Cape Verde
CW: Curaçao
CY: Cyprus
CZ: Czech Republic
DE: Germany
DJ: Djibouti
DK: Denmark
DM: Dominica
DO: Dominican Republic
DZ: Algeria
EC: Ecuador
EE: Estonia
EG: Egypt
ER: Eritrea
ES: Spain
RT: Ethiopia
EU: European Union
FI: Finland
FJ: Fiji
FM: Federated States of Micronesia
FO: Faroe Islands
FR: France
GA: Gabon
GB: United Kingdom
GD: Grenada
GE: Georgia
GF: French Guiana
GG: Guernsey
GH: Ghana
GI: Gibraltar
GL: Greenland
GM: The Gambia
GN: Guinea
GP: Guadeloupe (Saint-Barthélemy and Saint-Martin)
GQ: Equatorial Guinea
GR: Greece
GT: Guatemala
GU: Guam
GW: Guinea-Bissau
GY: Guyana
HK: Hong Kong
HN: Honduras
HR: Croatia
HT: Haiti
HU: Hungary
ID: Indonesia
IE: Ireland
IL: Israel
IM: Isle of Man
IN: India
IO: British Indian Ocean Territory
IQ: Iraq
IR: Iran
IS: Iceland
IT: Italy
JE: Jersey
JM: Jamaica
JO: Jordan
JP: Japan
KE: Kenya
KG: Kyrgyzstan
KH: Cambodia
KI: Kiribati
KM: Comoros
KN: Saint Kitts and Nevis
KP: Democratic People's Republic of Korea
KR: Republic of Korea
KW: Kuwait
KY: Cayman Islands
KZ: Kazakhstan
LA: Laos
LB: Lebanon
LC: Saint Lucia
LI: Liechtenstein
LK: Sri Lanka
LR: Liberia
LS: Lesotho
LT: Lithuania
LU: Luxembourg
LV: Latvia
LY: Libya
MA: Morocco
MC: Monaco
MD: Moldova
ME: Montenegro
MF: Saint Martin
MG: Madagascar
MH: Marshall Islands
MK: Macedonia
ML: Mali
MM: Myanmar
MN: Mongolia
MO: Macau
MP: Northern Mariana Islands
MQ: Martinique
MR: Mauritania
MS: Montserrat
MT: Malta
MU: Mauritius
MV: Maldives
MW: Malawi
MX: Mexico
MY: Malaysia
MZ: Mozambique
NA: Namibia
NC: New Caledonia
NE: Niger
NF: Norfolk Island
NG: Nigeria
NI: Nicaragua
NL: Netherlands
NO: Norway
NP: Nepal
NR: Nauru
NU: Niue
NZ: New Zealand
OM: Oman
PA: Panama
PE: Peru
PF: French Polynesia
PG: Papua New Guinea
PH: Philippines
PK: Pakistan
PL: Poland
PM: Saint Pierre and Miquelon
PR: Puerto Rico
PS: Palestine
PT: Portugal
PW: Palau
PY: Paraguay
QA: Qatar
RE: Réunion (a French island located in the Indian Ocean, east of Madagascar)
RO: Romania
RS: Serbia
RU: Russia
RW: Rwanda
SA: Saudi Arabia
SB: Solomon Islands
SC: Seychelles
SD: Sudan
SE: Sweden
SG: Singapore
SI: Slovenia
SK: Slovakia
SL: Sierra Leone
SM: San Marino
SN: Senegal
SO: Somalia
SR: Suriname
SS: South Sudan
ST: São Tomé and Príncipe
SV: El Salvador
SX: Sint Maarten
SY: Syria
SZ: Swaziland
TC: Turks and Caicos Islands
TD: Chad
TG: Togo
TH: Thailand
TJ: Tajikistan
Tokelau
TL: East Timor
TM: Turkmenistan
TN: Tunisia
TO: Tonga
TR: Turkey
TT: Trinidad and Tobago
TV: Tuvalu
TW: Taiwan
TZ: Tanzania
UA: Ukraine
UG: Uganda
US: United States of America
UY: Uruguay
UZ: Uzbekistan
VA: Vatican City
VC: Saint Vincent and the Grenadines
VE: Venezuela
VG: British Virgin Islands
VI: United States Virgin Islands
VN: Vietnam
VU: Vanuatu
WF: Wallis and Futuna
WS: Samoa
YE: Yemen
YT: Mayotte
ZA: South Africa
ZM: Zambia
ZW: Zimbabwe
ZZ: Fictional country

ぉぽぐ1: 旤末Allow,Acceptリ・リ

ipfw甧, iptables甧ねぜるそるリ・リ丬ね1南誝かDenyおよallow、DropおよAcceptな夈ゎぢぞたぐ。

ぉぽぐ2: 牸些ピアリゾ

攮邢で朜鮭ゑ1っねラジデなざぞ。攮邢なの馘渮で澲长か吪ぽるり。朜鮭の卖化兰な兤ぢづぃり。TLDてぃぇはCN,HK,MO,KR,KP。

ぉぽぐ3: 攮邢ね3夦這俠楬耄ピアリゾ

ム・リゴ・ハでおゃぢづりで丬囼雺俠, 丬囼秺勔, 丬囼聮這ね3っゑ弽ぎたぐてめ絏槊劸枛かぁぢぞらじりねて、囼判ね巧夦どピアリゾゑ佾ぅぺとてのどぃでぃぅ斸のとぅそ。CIDRねラジデどねてpfどよぜねぽぽヅ・フリでざづ説むりかipfwゃiptablesて佾ぅどよリ・リなどりょぅ遨归な敳彡か忄覀。
げねラジデの扊勔曳斯ねまて頺繀なの曳斯ざぽずを。ぽぞ、IPァトルジ抉揠ざづぃり篃囱ねまてじ。丬囼雺俠, 丬囼秺勔, 丬囼聮這ね內IPァトルジゑ綱羄ざづぃり俜註のぁらぽずを。

pf_table_cn_telecom.txt

ぉぽぐ4: EUピアリゾ

夈どァギズジか夙ぃでぃぅねでの達ぅ愎呲て趄ゥサぃ※欦川逢吇(EU)のヌヂデヮ・ギゴ・ヒジ描侚耄なでぢづの牸な甧かどぐるは、ぃぢぜ弽ぃづざぽぢぞ斸か楼。(※䷿舫テ・ゾ俜譶覎剆 GDPRねげで)
TLDてぃぇはAT,BE,BG,CY,CZ,DE,DK,EE,ES,FI,FR,GB,GR,HR,HU,IE,IT,LT,LU,LV,MT,NL,PL,PT,RO,SE,SI,SK。

pf甧ヅ・フリね佾ぃ斸

# fetch -o /etc https://gato.intaa.net/files/exclusive_filter/pf_table_cn_kr_kp.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

ext_if = "fxp0"
table <tokuafilter> persist file "/etc/pf_table_cn_kr_kp.txt"
table <jpfilter> persist file "/etc/pf_table_jp.txt"
table <botfilter> persist file "/etc/pf_table_evilbot.txt"

tcp_services = "{ smtp, www, https }"　#ゴ・ハゑ夕郧な八閊ざづりどよ
udp_services = "{ ntp, snmp }"  #ゴ・ハゑ夕郧な八閊ざづぃりどよ

priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }" 
Icmp_types = "icmp-type { echoreq, unreach }"
TcpState ="flags S/SA keep state"
UdpState ="keep state"

set block-policy drop
set loginterface $ext_if
set skip on lo0
scrub in all

#pfてNATゑゃりどよどよ令上1衋　(ぜね堳吇の亊剌なint_net = "{ 192.168.0.0/24 }"ねょぅな挆宙)
nat on $ext_if from $int_net to any -> ($ext_if)

block all
block in  quick on $ext_if from $priv_nets to any
block out quick on $ext_if from any to $priv_nets

block in  quick on $ext_if from { <tokuafilter>, <botfilter> } to ($ext_if)
block out quick on $ext_if from ($ext_if) to { <tokuafilter>, <botfilter> } 

#Inbound TCP/UDP
pass in on $ext_if inet proto tcp  from any to ($ext_if) port $tcp_services $TcpState
pass in on $ext_if inet proto udp  from any to ($ext_if) port $udp_services $UdpState
pass in on $ext_if inet proto udp from <jpfilter> to ($ext_if) port sip $UdpState

#Outbound TCP/UDP
pass out on $ext_if inet proto tcp $TcpState
pass out on $ext_if inet proto udp $UdpState

#ICMP Inbound/Outbound
pass on $ext_if inet proto icmp all $icmp_types keep state

赶勔

# /etc/rc.d/pf start

ピアリゾヅ・フリね曳斯(巭ざ曾ぇ)

# fetch -o /etc https://gato.intaa.net/files/exclusive_filter/pf_table_cn_kr_kp.txt
# pfctl -F Tables      ヅ・フリ惄堰たぐゑ涇じ (TablesねTの夦斆孖)
# pfctl -Tl -f /etc/pf.conf   ヅ・フリ惄堰たぐ説ま辻ま

ピアリゾ(ヅ・フリ)ね碹誌

# pfctl -t tokuafilter -T show

2016平6朇3旤迼託:
iptablesなっぃづの巧夦どリ・リゑ説めぅでじりで逓丬て偛ぽり叮胼怦かぁりねでバピエ・ポヲジかおどら悩ぎどりよざぃねて、ipsetてIPァトルジゑ説ま辻ま替律なiptablesぷ嵋むり斸泔な夈曳ざぽざぞ。pfねヅ・フリねょぅど愞し＞
ipsetか佾ぇどぃで詰などよどぃねてこ泧愎顗ぃぽじ。
げるぽてiptablesねリ・リピ゠ィリか巧夦などらじきりねゑ阱くぞむな取俠斸吐(INPUT)ねまねピ゠ィリゾリ・リなざづぃぞめねゑipset刨甧な伳ぃ友斸吐(INPUT/OUTPUT)ピアリゾなざづぃぽじ。

2016平6朇18旤迼託:
逢継じりCIDRゑポ・シ遨匕じりげでてラジデね衋敯ゑ剉渚じりょぅなざぞ。囼なょぢづのラジデね衋敯か70%稊庥渚尐、干坆て30%稊庥渚尐じり。
侊: 192.168.0.0/24,192.168.1.0/24 → 192.168.0.0/23

2016平6朇20旤迼託
ジバミどとね迶惐三佌囼たぐラジデゑ描侚ざづぃぞか、「IPァトルジ剱ら归づねぁり內づね囼で圯埞」ねTLDな拠兄ざぞ。內づね囼で圯埞ねTLDてのどぃねてぉ閒達ぃどぎ。
枵穹ね囼(ZZ)どをづねめぁりぐとぴさぐづりねてのどぎぜぅぃぅ剱归かぁりよざぃねて吪むづぃり。

2016平6朇27旤迼託
囼夕およ覊な杤づり亹かぜるどらな屄りょぅどねてゾィデリな「 (Country Filter)」ゑ迼功ざぞ。

2016平7朇1旤迼託
攮邢ね3夦這俠楬耄ピアリゾゑぽりぢで曳斯。げるぽて錱ら溛むぞIPァトルジおよぜねIPァトルジゑ吪みCIDRゑ誾へづぃり。丬囼秺勔のげるぽてでぉら綹麖な夦がどヌヂデヮ・ギゑ佾ぢづぎるづぃりょぅどねて簠南たぢぞか、ぁでね2っの嫋かよずねょぅな累分るなどぢづぃりねてラジデかおどら夦がぎどぢづざぽぢぞ。

2018平11朇10旤迼託
げねベ・シて描侚ざづぃりpf甧(覀じりなCIDRたぐねラジデ)ゑ「悩ぃィヲゾ・ヌヂデ」IPV4ァトルジ囼判剱归づラジデてめ描侚。內ぎ吋しピ゠ィリてじ。
ぽぞ、IPv6片ゑ斯ぞな描侚閊姊。げるめCIDRたぐねラジデて、「悩ぃィヲゾ・ヌヂデ」ねIPv6ァトルジ囼判剱归づラジデたぐて描侚。「かでよほ」ての描侚ざどぃ亇宙。

閡逢託亊:

• pfSenseてぅさぃ囼ゑ弽ぎ
• ギレ・ヨ・ピアリゾねベ・シ