country-block Debian package

Install country-block from this Debian apt repository to manage country-based firewall blocking with ipset, iptables, ip6tables, and automatic update jobs.

This package is in development and not intended for use in production environments.

Use this package at your own risk. It changes firewall rules and can affect network access. For interactive changes, prefer sudo country-block edit so new rules are tested temporarily before they become persistent.

This country block Debian firewall package installs from an apt repository and uses automatic install and update hooks to block incoming, outgoing, or forwarded traffic for configured countries. Country IP lists are downloaded from IPdeny and stored locally so firewall rules can be restored after reboot.

• IPv4 lists: https://www.ipdeny.com/ipblocks/data/countries
• IPv6 lists: https://www.ipdeny.com/ipv6/ipaddresses/blocks

Install from the apt repository

Debian Bookworm

sudo install -d -m 0755 /usr/share/keyrings
curl -fsSL https://newfullname.github.io/debian/pubkey.gpg \
  | sudo tee /usr/share/keyrings/newfullname-debian.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/newfullname-debian.gpg] https://newfullname.github.io/debian bookworm main" \
  | sudo tee /etc/apt/sources.list.d/newfullname-debian.list
sudo apt update
sudo apt install country-block

Debian Trixie

sudo install -d -m 0755 /usr/share/keyrings
curl -fsSL https://newfullname.github.io/debian/pubkey.gpg \
  | sudo tee /usr/share/keyrings/newfullname-debian.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/newfullname-debian.gpg] https://newfullname.github.io/debian trixie main" \
  | sudo tee /etc/apt/sources.list.d/newfullname-debian.list
sudo apt update
sudo apt install country-block

What gets configured automatically

Installing the Debian package configures the firewall workflow around IPdeny country lists, ipset sets, and iptables rules. The package downloads country network ranges, stores them in efficient sets, and applies matching firewall drops for the configured directions and IP versions.

• IPdeny provides the IPv4 and IPv6 country block lists used for firewall decisions.
• ipset stores large country IP ranges efficiently so rules stay manageable.
• iptables and ip6tables apply drop rules for input, output, or forward traffic.
• systemd restores cached country-block rules during boot so configured blocking persists after restart.
• A weekly systemd timer refreshes country lists and reapplies the firewall rules automatically.

Supported Debian releases

This repository supports Debian Bookworm and Debian Trixie on amd64 and arm64. The package architecture is all and depends on ipset, iptables, and curl.

Configure country firewall rules

For remote machines, prefer the safe editor because it tests the new rules before replacing the persistent config.

sudo country-block edit

Configuration entries use the format <country-codes> <chains> <ip-versions>. Chains can be input, output, forward, or *. IP versions can be v4, v6, or *.

# Block all traffic for Russia and Iran, IPv4 and IPv6
ru,ir * *

# Block only incoming IPv4 traffic from China
cn input v4

Safe changes

country-block edit opens a temporary copy of /etc/country-block/config.conf with ${EDITOR:-vi}, prepares any missing country ipsets, applies the edited rules temporarily, and asks you to type yes within 120 seconds. If you confirm, the temporary file becomes the persistent config. If you disconnect, press Ctrl-C, or do not confirm in time, the previous firewall state is restored and the persistent config is left unchanged.

sudo country-block edit --timeout 300

For generated configs or automation, use try directly.

sudo country-block try --config ./candidate.conf --timeout 120

After changing rules, sudo country-block update downloads the latest country lists, updates the ipsets, and applies the matching firewall rules immediately. Weekly updates are handled automatically by country-block.timer.

Upgrade, uninstall, and troubleshooting

Upgrade

sudo apt update
sudo apt install --only-upgrade country-block

Uninstall

sudo apt remove country-block

Removing the package stops the systemd units, removes managed firewall rules marked with the country-block-rule comment, and destroys managed ipsets named with the country_ prefix. To also remove package configuration and cached runtime data, purge the package.

sudo apt purge country-block

Troubleshooting

systemctl status country-block.service
systemctl status country-block.timer
sudo journalctl -u country-block.service -u country-block-update.service
sudo country-block update
sudo country-block apply

The command must run as root when changing firewall state. If an update cannot download a country list, check network access to IPdeny and rerun sudo country-block update.

Source

Package source and documentation: country-block.