Yama's Memorandum

# 特定の国（日本国内）からのアクセスを許可する
if [ -s ./iplist ]; then
     iptables -N ACCEPT_JP_FILTER
     sed -n 's/^JP\t//p' ./iplist | while read address;
     do
          iptables -A ACCEPT_JP_FILTER -s $address -j ACCEPT
     done
fi

# 特定の国（中国、韓国）からのアクセスを拒否する
if [ -s ./iplist ]; then
     iptables -N DROP_COUNTRY_FILTER
     sed -n 's/^\(CN\|KR\)\t//p' ./iplist | while read address;
     do
          iptables -A DROP_COUNTRY_FILTER -s $address -j DROP
     done
     iptables -A INPUT -j DROP_COUNTRY_FILTER
fi

# For SSH(tcp 22) with hashlimit
/sbin/iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m hashlimit \
   --hashlimit-name ssh_limit --hashlimit 1/m --hashlimit-burst 5 \
   --hashlimit-mode srcip --hashlimit-htable-expire 360000 -j ACCEPT_JP_FILTER

# For HTTP(tcp 80)
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Other Services are followed