I was DDos Attacked by Chinese Great Firewall twice this year.Now I download zone file from http://www.ipdeny.com/ipblocks/ .I want to do these things:If Someone from Anywhere wants to connect to my server's specific port,All can be come in.If Someone from China wants to connect to my server's any other ports,All packets should be dropped.Anyone else from other country can connect to my server correctly.How Can I do?I use a Cloudflare CDN free plan, but I just want to do above things on my server.
Ban IP using Iptables/Firewalld
debian;centos;iptables;firewalld
If you are using iptables it will return on the first matching rule. If you want to allow http for example and deny the other ports for China, ensure that the http allow rule comes first:iptables -A INPUT -d myhost --dport 80 -j ACCEPTiptables -A INPUT -m set --match-set china src -j DROPUsing the above statements you will need to create an ipset for china using:ipset create china hash:netwhile read line; do ipset add china $line; done < china.ipblock-file