From 5b104e1a64071dba81e409cfdd308e150a9eea55 Mon Sep 17 00:00:00 2001
From: salem <77879189@qq.com>
Date: Sun, 6 Sep 2026 20:01:54 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20=E9=98=B2=E7=81=AB?=
 =?UTF-8?q?=E5=A2=99.MD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 防火墙.MD | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/防火墙.MD b/防火墙.MD
index 66b0f08..ff48c90 100644
--- a/防火墙.MD
+++ b/防火墙.MD
@@ -6,4 +6,24 @@
 ~~~
 apt update
 apt install ipset curl -y
+~~~
+2. 创建 ipset 集合存储中国大陆 IP 段, 创建集合，hash:net 存放网段
+~~~
+ipset create cn_ip hash:net family inet hashsize 1024 maxelem 65536
+~~~
+3. 获取中国大陆 IP 网段并导入 ipset
+~~~
+##### 清空旧集合
+ipset flush cn_ip
+#### 下载cn网段列表写入ipset
+curl -s https://ftp.apnic.net/stats/apnic/delegated-apnic-latest | awk -F'|' '$2=="CN"&&$3=="ipv4"{printf("add cn_ip %s/%d\n",$4,32-log($5)/log(2))}' | ipset restore
+~~~
+⚠️网络不好时 curl 会失败，可以把文件下载到本地再导入。
+4. iptables 规则：拒绝 cn_ip 集合访问本机 40000‑50000 TCP/UDP
+~~~
+#### TCP
+iptables -A INPUT -m set --match-set cn_ip src -p tcp --dport 40000:50000 -j DROP
+##### UDP
+iptables -A INPUT -m set --match-set cn_ip src -p udp --dport 40000:50000 -j DROP
+
 ~~~
\ No newline at end of file