I got tired of repeated SSH attemptsĀ and honest for my home network, there's few countries that need to be logging into my system, so I'm using a combination of fail2ban and blocking by country.

I created this script to make my life easier and thought I would share it.

#!/bin/bash
# Based on the below article
# https://www.linode.com/community/questions/11143/top-tip-firewalld-and-ipset-country-blacklist

ipdeny_tmp_dir=$(mktemp -d -t blacklist-XXXXXXXXXX)
pushd $ipdeny_tmp_dir
curl -LO http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
tar xf all-zones.tar.gz

firewall-cmd --permanent --delete-ipset=blacklist
firewall-cmd --permanent --new-ipset=blacklist --type=hash:net --option=family=inet --option=hashsize=4096 --option=maxelem=200000
firewall-cmd --permanent --ipset=blacklist --add-entries-from-file=./cn.zone
firewall-cmd --permanent --ipset=blacklist --add-entries-from-file=./id.zone
firewall-cmd --permanent --ipset=blacklist --add-entries-from-file=./kn.zone
firewall-cmd --permanent --ipset=blacklist --add-entries-from-file=./ph.zone
firewall-cmd --permanent --ipset=blacklist --add-entries-from-file=./ru.zone

# Only need to do this part once
#firewall-cmd --permanent --zone=drop --add-source=ipset:blacklist

firewall-cmd --reload

popd
rm -rf $ipdeny_tmp_dir

Thanks,
Richard