iptables-extension-asn

KO | EN

gitlite — search

#ai #llm #golang #android #linux #docker #macos #awesome #cli #kubernetes #vue #security #pytorch #ios

iptables-extension-asn

(★ 9)

iptables extenssion addon xt_asn for matching ASN

iptables-extension-asn Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# xt_asn - IPTables ASN Filtering Module

[![License: GPL v2](https://img.shields.io/badge/License-GPL%20v2-blue.svg)](https://raw.githubusercontent.com/CageForge/iptables-extension-asn/master/LICENSE)
[![Build Status](https://github.com/username/xt_asn/workflows/CI/badge.svg)](https://github.com/username/xt_asn/actions)

An advanced iptables/netfilter kernel module for filtering network traffic based on Autonomous System Numbers (ASN). This module enables efficient packet filtering by ASN, making it useful for geolocation-based filtering, traffic analysis, and network security applications.

## 🚀 Features

- **4-byte ASN Support**: Full support for modern 4-byte ASN numbers (improved from original 2-byte limitation)
- **Dual Stack**: Complete IPv4 and IPv6 support
- **High Performance**: Binary search algorithm for efficient IP range matching
- **Real-time Updates**: Automated BGP data processing from RouteViews.org
- **Kernel Integration**: Native netfilter integration with minimal overhead
- **Country Detection**: Determine country for IP address ranges based on ASN data

## 📋 Requirements

### System Requirements
- Linux kernel 3.7+ (tested up to 5.x)
- iptables 1.4.5+
- gcc compiler
- Kernel headers for your running kernel

### Build Dependencies
- autotools (autoconf, automake, libtool)
- pkg-config
- xtables development headers

### Runtime Dependencies
- bgpdump utility
- Perl with modules:
  - Net::IP
  - Net::Netmask
  - Text::CSV_XS
  - Getopt::Long

## 🔧 Installation

### Quick Install (Ubuntu/Debian)

```bash
# Install dependencies
sudo apt-get update
sudo apt-get install -y build-essential linux-headers-$(uname -r) \
    iptables-dev autotools-dev autoconf automake libtool pkg-config \
    bgpdump libtext-csv-xs-perl libnet-ip-perl libnet-netmask-perl

# Clone and build
git clone https://github.com/username/xt_asn.git
cd xt_asn
./autogen.sh
./configure
make
sudo make install
```

### Manual Build Process

1. **Prepare build environment:**
   ```bash
   ./autogen.sh
   ./configure --with-kbuild=/lib/modules/$(uname -r)/build
   ```

2. **Compile the module:**
   ```bash
   make
   ```

3. **Install the module:**
   ```bash
   sudo make install
   sudo depmod -a
   ```

4. **Load the kernel module:**
   ```bash
   sudo modprobe xt_asn
   ```

### Generate ASN Database

```bash
# Update ASN data configuration
sudo nano /usr/local/bin/update-asndata.sh  # Set ASN_DATA_DIR
sudo nano /usr/local/bin/download-asndata.sh  # Set ASN_DATA_URL

# Generate initial database
sudo /usr/local/bin/download-asndata.sh
```

## 📖 Usage

### Basic Syntax

```bash
iptables -m asn [!] --src-asn ASN[,ASN...] ...
iptables -m asn [!] --dst-asn ASN[,ASN...] ...
```

### Examples

**Block traffic from specific ASN:**
```bash
iptables -A INPUT -m asn --src-asn 15169 -j DROP
# Block incoming traffic from Google's ASN
```

**Allow traffic to multiple ASNs:**
```bash
iptables -A OUTPUT -m asn --dst-asn 15169,8075,13335 -j ACCEPT
# Allow outgoing traffic to Google, Microsoft, and Cloudflare
```

**Country-based filtering with ASN:**
```bash
iptables -A INPUT -m asn --src-asn 15169 -m comment --comment "Google AS" -j ACCEPT
iptables -A OUTPUT -m asn --dst-asn 15169 -m comment --comment "Google AS" -j ACCEPT
```

**Complex rules with negation:**
```bash
iptables -A FORWARD -m asn ! --src-asn 12345,67890 -j LOG --log-prefix "Non-trusted ASN: "
# Log traffic NOT from trusted ASNs
```

**Rate limiting by ASN:**
```bash
iptables -A INPUT -m asn --src-asn 15169 -m limit --limit 100/sec -j ACCEPT
# Rate limit traffic from specific ASN
```

## 🔄 ASN Data Management

### Automated Updates

The module uses a two-stage update process for optimal performance:

1. **Central Processing** (`update-asndata.sh`):
   - Downloads raw BGP data from RouteViews.org
   - Processes data into CSV format
   - Should run on a central server

2. **Local Updates** (`download-asndata.sh`):
   - Downloads processed CSV data
   - Converts to binary format for kernel module
   - Runs on each server using xt_asn

### Setup Automated Updates

```bash
# Edit configuration
sudo vi /usr/local/bin/update-asndata.sh
# Set: ASN_DATA_DIR="/var/lib/xt_asn"

sudo vi /usr/local/bin/download-asndata.sh  
# Set: ASN_DATA_URL="http://your-server.com/asn.csv"

# Setup cron job for daily updates
echo "0 6 * * * /usr/local/bin/download-asndata.sh" | sudo crontab -
```

### Manual Database Update

```bash
# Update ASN database manually
sudo /usr/local/bin/download-asndata.sh

# Reload module to use new data
sudo rmmod xt_asn
sudo modprobe xt_asn
```

## 🧪 Testing

### Verify Installation

```bash
# Check if module is loaded
lsmod | grep xt_asn

# Test iptables integration
iptables -m asn --help

# Verify database files
ls -la /usr/share/xt_asn/
```

### Test Filtering

```bash
# Add test rule
iptables -A INPUT -m asn --src-asn 15169 -j LOG --log-prefix "Google ASN: "

# Check logs
tail -f /var/log/kern.log | grep "Google ASN"
```

## 🛠️ Troubleshooting

### Common Issues

**Module loading fails:**
```bash
# Check kernel version compatibility
uname -r
dmesg | grep xt_asn

# Verify kernel headers
ls /lib/modules/$(uname -r)/build
```

**Size mismatch error:**
```
asn.1 match: invalid size 152 (kernel) != (user) 184
```
**Solution:**
```bash
sudo rmmod xt_asn
sudo modprobe xt_asn
```

**Database not found:**
```bash
# Check database directory
ls -la /usr/share/xt_asn/
# Regenerate database
sudo /usr/local/bin/download-asndata.sh
```

### Debug Mode

```bash
# Enable debug logging
echo 1 > /proc/sys/net/netfilter/nf_log_all_netns

# Check detailed logs
dmesg | grep -i asn
```

## 🏗️ Development

### Building from Source

```bash
git clone https://github.com/username/xt_asn.git
cd xt_asn
./autogen.sh
./configure --enable-debug
make clean && make
```

### Running Tests

```bash
make check
```

### Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests
5. Submit a pull request

## 📊 Performance

- **Lookup Speed**: O(log n) binary search
- **Memory Usage**: ~1MB per 10,000 IP ranges
- **CPU Overhead**: <1% on modern systems
- **Supported Load**: Tested up to 1M packets/second

## 🔧 Configuration Files

### Default Paths

- **Database**: `/usr/share/xt_asn/`
- **Scripts**: `/usr/local/bin/`
- **Config**: `/etc/xt_asn/`
- **Logs**: `/var/log/xt_asn.log`

### Database Format

```
Binary files per ASN:
- BE/ (Big Endian): for big-endian systems
- LE/ (Little Endian): for little-endian systems
- *.iv4: IPv4 ranges
- *.iv6: IPv6 ranges
```

## 📝 Changelog

### Version 2.1.0 (Current)
- Added 4-byte ASN support
- Fixed compatibility with iptables-services
- Improved error handling
- Updated documentation

### Version 2.0.0
- Complete rewrite for modern kernels
- IPv6 support added
- Performance optimizations

## 🆘 Support

- **Issues**: [GitHub Issues](https://github.com/username/xt_asn/issues)
- **Documentation**: [Wiki](https://github.com/username/xt_asn/wiki)
- **Discussions**: [GitHub Discussions](https://github.com/username/xt_asn/discussions)

## 📄 License

This project is licensed under the GNU General Public License v2.0 - see the [LICENSE](LICENSE) file for details.

## 🙏 Acknowledgments

- Original authors: Samuel Jean & Nicolas Bouliane
- RouteViews.org for BGP data
- Netfilter/iptables development team
- All contributors and users

## 🔗 Related Projects

- [xt_geoip](https://github.com/jengelh/xtables-addons) - Geographic IP filtering
- [ipset](http://ipset.netfilter.org/) - IP set management
- [fail2ban](https://www.fail2ban.org/) - Intrusion prevention

---

**⚠️ Important Security Notice**

This module processes network traffic at the kernel level. Always test rules thoroughly in a safe environment before deploying to production systems. Incorrect configuration may block legitimate traffic or create security vulnerabilities.

For enterprise deployments, consider implementing proper monitoring, alerting, and rollback procedures.

iptables-extension-asn

iptables-extension-asn Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

iptables-extension-asn

iptables-extension-asn Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README