nft-geoblock.sh

Load country IP blocks into an nftables verdict map to block (or allow) traffic by country.

sudo ./nft-geoblock.sh [-n name] [-p ports] [-w] CC [CC ...]

# Block DE + RU on all ports
sudo ./nft-geoblock.sh DE RU

# Block CN only on 80/443
sudo ./nft-geoblock.sh -p 80,443 CN

# Allow only FR/ES on 443, drop everyone else
sudo ./nft-geoblock.sh -w -p 443 FR ES

• Requires root, nft, and curl.
• Port 22 (SSH) is never filtered. Without -p it is auto-exempted; with -p any occurrence of 22 (incl. inside ranges) aborts the script.
• Rules hook input at priority mangle, policy accept.
• IP lists are fetched from ipdeny.com.