Extended version of sshfilter.sh to recognized private ip addresses and realy unknown ip addresses

Konsole output

/var/log/messages

Dec 12 16:03:39 bananapi logger: DENY sshd connection from 113.108.21.16 (CN)
Dec 12 16:12:59 bananapi logger: DENY sshd connection from 185.110.132.202 (IP Address not found)
Dec 12 16:20:12 bananapi logger: DENY sshd connection from 121.18.238.98 (CN)
Dec 12 16:24:57 bananapi logger: DENY sshd connection from 185.110.132.202 (IP Address not found)
Dec 12 16:26:20 bananapi logger: DENY sshd connection from 121.18.238.114 (CN)
Dec 12 16:29:10 bananapi logger: DENY sshd connection from 221.194.44.195 (CN)
Dec 12 16:30:55 bananapi logger: DENY sshd connection from 221.194.47.249 (CN)
Dec 12 16:37:06 bananapi logger: DENY sshd connection from 185.110.132.202 (IP Address not found)
Dec 12 16:49:14 bananapi logger: DENY sshd connection from 185.110.132.202 (IP Address not found)
Dec 12 16:59:37 bananapi logger: DENY sshd connection from 54.249.52.56 (JP)
Dec 12 17:50:04 bananapi logger: ALLOW sshd connection from 192.168.0.10 (Private network)

bananapi:~# geoiplookup 185.110.132.202
GeoIP Country Edition: IP Address not found

/var/log/messages ... test from intern to extern ip address from t-online
Dec 12 18:26:35 bananapi logger: DENY sshd connection from 222.239.10.143 (KR)
Dec 12 18:41:05 bananapi logger: ALLOW sshd connection from 46.92.139.127 (DE) <= ok

sshfilter.sh

#!/bin/bash
# based on script from http://www.axllent.org/docs/view/ssh-geoip

function private_ip()
{
  local  ip=$1
  local  stat=1

  if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
    OIFS=$IFS
    IFS='.'
    ip=($ip)
    IFS=$OIFS

    # ip address in decimal
    dec=$[((((( ${ip[0]} * 256 ) + ${ip[1]} ) * 256 ) + ${ip[2]} ) * 256 ) + ${ip[3]}]
    #echo "ip dec: "$dec

    # Soure: https://en.wikipedia.org/wiki/Reserved_IP_addresses
    scope=""

    # 0.0.0.0 to 0.255.255.255
    if [[ $dec -ge 0x00000000 && $dec -le 0x00FFFFFF ]]; then
      scope="Software"

    # 10.0.0.0 to 10.255.255.255
    elif [[ $dec -ge 0x0A000000 && $dec -le 0x0AFFFFFF ]]; then
      scope="Private network"

    # 100.64.0.0 to 100.127.255.255
    elif [[ $dec -ge 0x64400000 && $dec -le 0x647FFFFF ]]; then
      scope="Private network"

    # 127.0.0.0 to 127.255.255.255
    elif [[ $dec -ge 0x7F000000 && $dec -le 0x7FFFFFFF ]]; then
      scope="Host"

    # 169.254.0.0 to 169.254.255.255
    elif [[ $dec -ge 0xA9FE0000 && $dec -le 0xA9FEFFFF ]]; then
      scope="Subnet"

    # 172.16.0.0 to 172.31.255.255
    elif [[ $dec -ge 0xAC100000 && $dec -le 0xAC1FFFFF ]]; then
      scope="Private network"

    # 192.0.0.0 to 192.0.0.255
    elif [[ $dec -ge 0xC0000000 && $dec -le 0xC00000FF ]]; then
      scope="Private network"

    # 192.0.2.0 to 192.0.2.255
    elif [[ $dec -ge 0xC0000200 && $dec -le 0xC00002FF ]]; then
      scope="Documentation"

    # 192.88.99.0 to 192.88.99.255
    elif [[ $dec -ge 0xC0586300 && $dec -le 0xC05863FF ]]; then
      scope="Internet"

    # 192.168.0.0 to 192.168.255.255
    elif [[ $dec -ge 0xC0A80000 && $dec -le 0xC0A8FFFF ]]; then
      scope="Private network"

    # 198.18.0.0 to 198.19.255.255
    elif [[ $dec -ge 0xC6120000 && $dec -le 0xC613FFFF ]]; then
      scope="Private network"

    # 198.51.100.0 to 198.51.100.255
    elif [[ $dec -ge 0xC6336400 && $dec -le 0xC63364FF ]]; then
      scope="Documentation"

    # 203.0.113.0 to 203.0.113.255
    elif [[ $dec -ge 0xCB007100 && $dec -le 0xCB0071FF ]]; then
      scope="Documentation"

    # 240.0.0.0 to 255.255.255.254
    elif [[ $dec -ge 0xF0000000 && $dec -le 0xFFFFFFFE ]]; then
      scope="Internet"

    # 255.255.255.255 to 255.255.255.255
    elif [[ $dec -ge 0xFFFFFFFF && $dec -le 0xFFFFFFFF ]]; then
      scope="Subnet"
    fi

  fi
  echo $scope
}


# UPPERCASE space-separated country codes to ACCEPT
#ALLOW_COUNTRIES="NZ AU"
ALLOW_COUNTRIES="DE"

if [ $# -ne 1 ]; then
  echo "Usage:  `basename $0` <ip>" 1>&2
  exit 0 # return true in case of config issue
fi

COUNTRY=`/usr/bin/geoiplookup $1 | awk -F ": " '{ print $2 }' | awk -F "," '{ print $1 }' | head -n 1`

#[[ $COUNTRY = "IP Address not found" || $ALLOW_COUNTRIES =~ $COUNTRY ]] && RESPONSE="ALLOW" || RESPONSE="DENY"

RESPONSE="DENY"
if [[ $ALLOW_COUNTRIES =~ $COUNTRY ]]; then
  RESPONSE="ALLOW"
elif [[ $COUNTRY = "IP Address not found" ]]; then
  COUNTRY=`private_ip $1`
  if [[ $COUNTRY != "" ]]; then
    RESPONSE="ALLOW"
  else
    COUNTRY="IP Address not found"
  fi
fi

# log always
logger "$RESPONSE sshd connection from $1 ($COUNTRY)"

if [ $RESPONSE = "ALLOW" ]; then
  exit 0
else
  exit 1
fi