Support whitelisting ports for country blocking (#6)

tomasz-c · Oct 18, 2021 · 06cfd4c · 06cfd4c
1 parent b20de77
commit 06cfd4c
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 1 deletion.
diff --git a/nft-blackhole.conf b/nft-blackhole.conf
@@ -44,3 +44,9 @@ COUNTRY_LIST: [cn, vn]
 # block - block coutries from list, accept others
 # accept - accept coutries from list, block others
 COUNTRY_POLICY: block
+
+
+# Country exclude ports: port numbers or names, e.g: [993, https]
+# List is available in /etc/services
+# These ports will be accessible on TCP and UDP protocols from all countries (but not from blacklisted IPs)
+COUNTRY_EXCLUDE_PORTS: []
diff --git a/nft-blackhole.py b/nft-blackhole.py
@@ -4,7 +4,7 @@
 
 __author__ = "Tomasz Cebula <tomasz.cebula@gmail.com>"
 __license__ = "MIT"
-__version__ = "1.0.0"
+__version__ = "1.1.0"
 
 import argparse
 from sys import stderr
@@ -48,13 +48,16 @@
                    '\t\tip daddr @blacklist-v4 counter ${block_policy}\n'
                    '\t\tip6 daddr @blacklist-v6 counter ${block_policy}\n\t}').expandtabs()
 
+COUNTRY_EX_PORTS_TEMPLATE = 'meta l4proto { tcp, udp } th dport { ${country_ex_ports} } counter accept'
+
 IP_VER = []
 for ip_v in ['v4', 'v6']:
     if config['IP_VERSION'][ip_v]:
         IP_VER.append(ip_v)
 
 BLOCK_POLICY = 'reject' if config['BLOCK_POLICY'] == 'reject' else 'drop'
 COUNTRY_POLICY = 'accept' if config['COUNTRY_POLICY'] == 'accept' else 'block'
+COUNTRY_EXCLUDE_PORTS = config['COUNTRY_EXCLUDE_PORTS']
 
 if COUNTRY_POLICY == 'block':
     default_policy = 'accept'
@@ -65,6 +68,12 @@
     block_policy = BLOCK_POLICY
     country_policy = 'accept'
 
+if COUNTRY_EXCLUDE_PORTS:
+    country_ex_ports = ', '.join(map(str, config['COUNTRY_EXCLUDE_PORTS']))
+    country_ex_ports_rule = Template(COUNTRY_EX_PORTS_TEMPLATE).substitute(country_ex_ports=country_ex_ports)
+else:
+    country_ex_ports_rule = ''
+
 if BLOCK_OUTPUT:
     chain_output = Template(OUTPUT_TEMPLATE).substitute(block_policy=block_policy)
 else:
@@ -95,6 +104,7 @@ def start():
     nft_template = open('/usr/share/nft-blackhole/nft-blackhole.template').read()
     nft_conf = Template(nft_template).substitute(default_policy=default_policy,
                                                  block_policy=block_policy,
+                                                 country_ex_ports_rule=country_ex_ports_rule,
                                                  country_policy=country_policy,
                                                  chain_output=chain_output)
 

diff --git a/nft-blackhole.template b/nft-blackhole.template
@@ -43,6 +43,7 @@ table inet blackhole {
                 ip6 saddr @whitelist-v6 counter accept
                 ip saddr @blacklist-v4 counter ${block_policy}
                 ip6 saddr @blacklist-v6 counter ${block_policy}
+                ${country_ex_ports_rule}
                 ip saddr @country-v4 counter ${country_policy}
                 ip6 saddr @country-v6 counter ${country_policy}
                 counter