This code can block domestic IP. Of course, by changing the IP library address (cn.zone file), you can block specific IPs and IP segments.

1. Block Chinese IP
Save the following code as blockcn.sh

 ipset -N china hash:net rm cn.zone wget -P . https://zhujiwiki.com/wp-content/uploads/2018/04/cn.zone for i in $(cat /root/cn.zone ); do ipset -A china $i; done iptables -I INPUT -p tcp -m set --match-set china src -j DROP

Then, execute:

 sh blockcn.sh

2. Unblock Chinese IP
Save the following code as boblockcn.sh:

 ipset -N china hash:net rm cn.zone wget -P . https://zhujiwiki.com/wp-content/uploads/2018/04/cn.zone for i in $(cat /root/cn.zone ); do ipset -A china $i; done iptables -D INPUT -p tcp -m set --match-set china src -j DROP

Then, execute:

 sh noblockcn.sh

via: https://www.lowendtalk.com/discussion/141800/blocking-attack-ips-ddos-ips-from-china

3. Further optimized script <br />This script is based on the IP segment provided by ipdeny.com. The above script can add and delete IP segments accurately and in real time, and each has its own advantages and disadvantages.
1. Download

 wget --no-check-certificate https://zhujiwiki.com/wp-content/uploads/2018/04/block-ips.sh

2. Use

Here we take China as an example. If you want to block other countries, please modify the last code parameter yourself.

Adding rules

 bash block-ips.sh -a cn

Start blocking

 bash block-ips.sh -b cn

List of blocked countries

 bash block-ips.sh -l

Unblock

 bash block-ips.sh -u cn

For other country codes, please visit: http://www.ipdeny.com/ipblocks

via: https://lolico.moe/projects/block-countries-ips.html