salem/3XUI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

更新 防火墙.MD

Browse Source
This commit is contained in:
salem
2026-09-06 20:02:31 +08:00
parent 5b104e1a64
commit aa35b7012f
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
防火墙.MD
+4 -4
View File
@@ -13,17 +13,17 @@ ipset create cn_ip hash:net family inet hashsize 1024 maxelem 65536
~~~ ~~~
3. 获取中国大陆 IP 网段并导入 ipset 3. 获取中国大陆 IP 网段并导入 ipset
~~~ ~~~
##### 清空旧集合 # 清空旧集合
ipset flush cn_ip ipset flush cn_ip
#### 下载cn网段列表写入ipset # 下载cn网段列表写入ipset
curl -s https://ftp.apnic.net/stats/apnic/delegated-apnic-latest | awk -F'|' '$2=="CN"&&$3=="ipv4"{printf("add cn_ip %s/%d\n",$4,32-log($5)/log(2))}' | ipset restore curl -s https://ftp.apnic.net/stats/apnic/delegated-apnic-latest | awk -F'|' '$2=="CN"&&$3=="ipv4"{printf("add cn_ip %s/%d\n",$4,32-log($5)/log(2))}' | ipset restore
~~~ ~~~
⚠️网络不好时 curl 会失败，可以把文件下载到本地再导入。 ⚠️网络不好时 curl 会失败，可以把文件下载到本地再导入。
4. iptables 规则：拒绝 cn_ip 集合访问本机 40000‑50000 TCP/UDP 4. iptables 规则：拒绝 cn_ip 集合访问本机 40000‑50000 TCP/UDP
~~~ ~~~
#### TCP # TCP
iptables -A INPUT -m set --match-set cn_ip src -p tcp --dport 40000:50000 -j DROP iptables -A INPUT -m set --match-set cn_ip src -p tcp --dport 40000:50000 -j DROP
##### UDP # UDP
iptables -A INPUT -m set --match-set cn_ip src -p udp --dport 40000:50000 -j DROP iptables -A INPUT -m set --match-set cn_ip src -p udp --dport 40000:50000 -j DROP
~~~ ~~~