spamhaus.sh improvements

LICENSE.md

@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org/>

README.md

@@ -1,5 +1,5 @@
 ## Spamhaus DROP List ##
-A shell script that grabs the latest Spamhaus DROP List and adds it to iptables. We use this (among other tools) on our Ubuntu proxy server at [AppThemes](http://www.appthemes.com/) to cut down on spam and other malicious activity.
+A shell script that grabs the latest Spamhaus DROP & EDROP Lists and adds them to iptables. We use this script (among other tools) on our Debian web server & Ubuntu proxy server at [AppThemes](http://www.appthemes.com/) to cut down on spam and other malicious activity.
 
 ## Usage ##
 Place the script somewhere on your server.
@@ -37,3 +37,6 @@ If you need to remove all the Spamhaus rules, run the following:
 <pre>
 sudo iptables -F Spamhaus
 </pre>
+<pre>
+sudo iptables -F SpamhausAct
+</pre>

spamhaus.sh

@@ -8,14 +8,25 @@
 IPTABLES="/sbin/iptables";
 
 # list of known spammers
-URL="www.spamhaus.org/drop/drop.lasso";
+URL1="http://www.spamhaus.org/drop/drop.lasso";
+URL2="http://www.spamhaus.org/drop/edrop.lasso";
 
 # save local copy here
-FILE="/tmp/drop.lasso";
+FILE1="/tmp/drop.lasso";
+FILE2="/tmp/edrop.lasso";
 
-# iptables custom chain
+# iptables custom chain for Bad IPs
 CHAIN="Spamhaus";
 
+# iptables custom chain for actions
+CHAINACT="SpamhausAct";
+
+# Outbound (egress) filtering is not required but makes your Spamhaus setup
+# complete by providing full inbound and outbound packet filtering. You can
+# toggle outbound filtering on or off with the EGF variable.
+# It is strongly recommended that this option NOT be disabled.
+EGF="1"
+
 # check to see if the chain already exists
 $IPTABLES -L $CHAIN -n
 
@@ -38,27 +49,52 @@ else
     # don't allow this traffic through
     $IPTABLES -A FORWARD -j $CHAIN
 
+    if [ $EGF -ne 0 ]; then
+        # don't allow access to bad IPs from us
+        $IPTABLES -A OUTPUT -j $CHAIN
+    fi
+
     echo "Chain not detected. Creating new chain and adding Spamhaus list...."
 
 fi;
 
-# get a copy of the spam list
-wget -qc $URL -O $FILE
+# create a new action set
+$IPTABLES -N $CHAINACT
+
+# flush the old action rules
+$IPTABLES -F $CHAINACT
 
-# iterate through all known spamming hosts
-for IP in $( cat $FILE | egrep -v '^;' | awk '{ print $1}' ); do
+# add the ip address log rule to the action chain
+$IPTABLES -A $CHAINACT -p 0 -j LOG --log-prefix "[SPAMHAUS BLOCK]" -m limit --limit 3/min --limit-burst 10
 
-    # add the ip address log rule to the chain
-    $IPTABLES -A $CHAIN -p 0 -s $IP -j LOG --log-prefix "[SPAMHAUS BLOCK]" -m limit --limit 3/min --limit-burst 10
+# add the ip address drop rule to the action chain
+$IPTABLES -A $CHAINACT -p 0 -j DROP
 
-    # add the ip address to the chain
-    $IPTABLES -A $CHAIN -p 0 -s $IP -j DROP
+for bl in 1 2
+do
+    URL="URL${bl}"
+    URL="${!URL}"
+    FILE="FILE${bl}"
+    FILE="${!FILE}"
+    # get a copy of the spam list
+    wget -qc ${URL} -O ${FILE}
 
-    echo $IP
+    # iterate through all known spamming hosts
+    for IP in $( cat $FILE | egrep -v '^\s*;' | awk '{ print $1}' ); do
 
+        # add the ip address to the chain (source filter)
+        $IPTABLES -A $CHAIN -p 0 -s $IP -j $CHAINACT
+
+        if [ $EGF -ne 0 ]; then
+            # add the ip address to the chain (destination filter)
+            $IPTABLES -A $CHAIN -p 0 -d $IP -j $CHAINACT
+        fi
+        echo $IP
+
+    done
+
+    # remove the spam list
+    unlink ${FILE}
 done
 
 echo "Done!"
-
-# remove the spam list
-unlink $FILE