Script to block all non-US IPs

Everyone,

I'm hosting an SSH server online and I have been tightening up access to it. 1. I only use certificate logins (8096 bit keys for the win). 2. I'm running fail2ban with 8 hour lockouts. While no one is going to guess a large key in 3 attempts, it is still a bit noisy. To clean this up I modified a script I found on the internet (Can't remember where I found it) to set up rules that will block all non-US IPs on IPV4 and IPV6. It also allows for localhost addresses to have access. It takes a while to load but it is set up so that you can put this in a cron job and run every week to adjust as IPs can move in and out of the U.S.

Usage: ./whitelist\_us.sh \[-p PORT\] \[-h\]

Options:

  \-p PORT    Restrict rules to specific port (e.g., -p 22 for SSH only)
  \-h         Show this help message
Examples:
  ./whitelist\_us.sh              # Block all non-US traffic on all ports
  ./whitelist\_us.sh -p 22        # Block non-US traffic only on port 22 (SSH)
  ./whitelist\_us.sh -p 80        # Block non-US traffic only on port 80 (HTTP)
  ./whitelist\_us.sh -p 443       # Block non-US traffic only on port 443 (HTTPS)

It can be found here: https://github.com/SteveBattista/whitelist_us