linux share anti complaints server

Yesterday there was a client who wants his website to block all IP from China and from China to visit redirected to a predetermined page (or site)。Orthodox approach should be used apache + mod_geoip or nginx + http_geoip_module do，But I found that the customers use the apache / directAdmin / suexec，suexec and seems to have a problem with mod_geoip，VPSee do not want to move a large client configuration，We intend to use iptables to implement this requirement。The idea is that，Using iptables to all traffic from China to guide site 81 port，And start listening on port 81 on apache，Put a predetermined page (or site)。

First IPdeny Download to country code-programmed list of IP addresses，Such as downloading cn.zone：

# wget http://www.ipdeny.com/ipblocks/data/countries/cn.zone

After obtaining all the required IP addresses，Read cn.zone file with the following script line by line and added to the iptables：

#!/bin/bash
# Redirect traffic from a specific country to a specific page
# written by vpsee.com

COUNTRY="cn"
YOURIP="1.2.3.4"

if [ "$(id -u)" != "0" ]; then
   echo "you must be root" 1>&2
   exit 1
fi

iptables -F
iptables -X
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT

# Redirect incoming http (80) from China to 81
for c in $COUNTRY
do
        country_file=$c.zone

        IPS=$(egrep -v "^#|^$" $country_file)
        for ip in $IPS
        do
           echo "redirecting $ip"
           iptables -t nat -I PREROUTING -p tcp --dport 80 -s $ip -j DNAT \
                   --to-destination $YOURIP:81
        done
done

iptables-save > /etc/sysconfig/iptables
chmod go-r /etc/sysconfig/iptables
service iptables restart

After this IP from China YOURIP visit the site will be automatically redirected to YOURIP:81 This port，We then modify the apache configuration，Add a Listen 81 DocumentRoot and well placed inside a predetermined page (or site) will be able to