Download a public blocklist of SSH brute scanning hosts and drop their connection attempts via pure iptables

ssh-blocks-pure-iptables.sh

#!/bin/sh

curl -s http://lists.blocklist.de/lists/ssh.txt > /tmp/ssh-ips.txt

if [ "$1" == "--force" ]; then
	iptables -F AUTO_BLACKLIST
	iptables -A AUTO_BLACKLIST -j RETURN
fi

/usr/sbin/iptables -L AUTO_BLACKLIST -n | awk '/^DROP / { print $4 }' > /tmp/ip_ssh_blocked

i=0
for src in $(cat /tmp/ssh-ips.txt); do
	if [ "$1" != "--force" ]; then
		grep -q "^$src\$" /tmp/ip_ssh_blocked || /usr/sbin/iptables -I AUTO_BLACKLIST -s $src -j DROP && i=$(($i + 1))
	else
		/usr/sbin/iptables -I AUTO_BLACKLIST -s $src -j DROP
		i=$(($i + 1))
	fi
done

echo $i hosts added