Setup your internal network/masks in ipset2.c:
-
static unsigned char prefix4[]={10}; // ={192,168}; -
static unsigned char prefix6[]={0x20,1, 7,0x38, 0x79,4}; // 2001:738:7904: -
int mask_s6=64; -
int mask_d6=48;
Build/compile:
- apt install libnetfilter-log1 libnetfilter-log-dev libmaxminddb-dev
- gcc -Wall -Wno-pointer-sign -Os ipstat2.c -o ipstat2 -lnetfilter_log -lmaxminddb
GeoIP databases: (path can be changed in ipstat2.c)
- /var/lib/GeoIP/GeoLite2-Country.mmdb
- /var/lib/GeoIP/GeoIP2-ISP.mmdb or /var/lib/GeoIP/GeoLite2-ASN.mmdb
Firewall settings: (traffic should be logged to NFLOG group 123)
for C in INPUUT FORWARD OUTPUT; do
iptables -I $C -j NFLOG --nflog-group 123 --nflog-threshold 64 --nflog-size 64
ip6tables -I $C -j NFLOG --nflog-group 123 --nflog-threshold 64 --nflog-size 64
done