kubesail-blacklist.sh.j2

#!/bin/bash

function valid_ip()
{
    local  ip=$1
    local  stat=1

    if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
        OIFS=$IFS
        IFS='.'
        ip=($ip)
        IFS=$OIFS
        [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
            && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
        stat=$?
    fi
    return $stat
}

function ban_ip() {
	local ip=$1
	if $(valid_ip $ip); then
		if [[ $(python -c "from IPy import IP; ip = IP('$ip'); print(ip.iptype())") == "PUBLIC" ]]; then
			iptables -A kubesail-blacklist -d $ip -j DROP
		fi
	fi
}

pip install IPy
iptables -N kubesail-blacklist
iptables -D OUTPUT -j kubesail-blacklist
iptables -A OUTPUT -j kubesail-blacklist
iptables -F kubesail-blacklist

for ADDRESS in $(cat /root/kubesail-blacklist.txt); do
	if $(valid_ip "$ADDRESS"); then
		ban_ip "$ADDRESS"
	else
		for IP_ADDRESS in $(host -v -t A "$ADDRESS" 1.1.1.1 | egrep 'IN\s+A' | awk '{print $5}' | egrep -v '^$'); do
			ban_ip "$IP_ADDRESS"
        	done 
	fi
done