A lightweight script to automatically block known malicious IPs on Linux servers using ipset
and iptables
.
This tool is based on PebbleHost's Hunter, which maintains a honeypot-driven IP blacklist.
Run the following commands in your terminal:
curl -fsSL https://raw.githubusercontent.com/Pixel-Services/HunterInstaller/refs/heads/main/hunter-installer.sh -o hunter-installer.sh
chmod +x hunter-installer.sh
./hunter-installer.sh
You'll be prompted to configure:
- Update frequency (in minutes)
- Target iptables chain:
DOCKER-USER
(for Docker) orINPUT
(default firewall)
- Fetches the latest IP blocklist from PebbleHost's Hunter project
- Applies blocks using
ipset
andiptables
- Sets up a
systemd
timer to auto-update regularly
systemctl status blocklist-update.timer
journalctl -u blocklist-update.service
Run the following one-liner to get rid of hunter and it's files and configurations:
curl -fsSL https://raw.githubusercontent.com/Pixel-Services/HunterInstaller/refs/heads/main/hunter-uninstall.sh | bash