CIDRe is a CLI tool that fetches daily updated IP allocations from Regional Internet Registries (RIRs), compiles them into country-based CIDR files, and allows easy firewall management. Daily automatic CIDR updates in the repository.
pip install cidre-clicidre cidr pull --merge- Downloads the latest CIDR allocations from RIRs.
- Merges overlapping IP ranges for efficiency.
# UFW is better suited for small CIDR inputs
cidre firewall deny ir kp --firewall ufw- Blocks Iran (IR), and North Korea (KP) in UFW.
- Requires ufw installed (
sudo apt install ufw).
# iptables is better suited for large CIDR inputs
cidre firewall deny ru ir kp --firewall iptables- Blocks Russia (RU), Iran (IR), and North Korea (KP) in iptables using ipset.
- Requires ipset and iptables installed (
sudo apt install ipset iptables).
pip install cidre-cligit clone https://github.com/vulnebify/cidre.git && cd cidre && python3 -m venv .venv && source .venv/bin/activate && pip install .| Command | Description |
|---|---|
cidre cidr pull |
Fetches the latest IP allocation data from all RIRs |
cidre cidr pull --merge |
Merges overlapping IP ranges for efficiency. Optional. |
cidre cidr pull --proxy PROXY |
Proxies connection to RIRs. Optional. |
cidre cidr pull --cidr-store PATH |
Specifies CIDRs' custom storage directory. Default: ./output/cidr |
| Command | Description |
|---|---|
cidre cidr count |
Counts amount of IPs per country |
cidre cidr count US CN |
Counts amount of IPs by country code (ISO 3166-1 alpha-2 code) |
cidre cidr count --cidr-store PATH |
Specifies CIDRs' custom storage directory. Default: ./output/cidr |
| Command | Description |
|---|---|
cidre firewall allow |
Apply allow rule to specified firewall |
cidre firewall deny |
Apply deny rule to specified firewall |
cidre firewall reject |
Apply reject rule to specified firewall |
cidre firewall reject --firewall ufw |
Firewall to apply rules. Options: ufw, iptables. Default: ufw |
cidre firewall reject --cidr-store PATH |
Specifies CIDRs' custom storage directory. Default: ./output/cidr |
To ensure iptables and IPSet rules persist after a reboot, follow these steps:
# Save rules based on the firewall method:
# - For iptables + IPSet:
sudo ipset save > /etc/ipset.rules
sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6
# Restore firewall rules on boot:
# - For iptables + IPSet:
sudo bash -c 'echo "ipset restore < /etc/ipset.rules" >> /etc/rc.local'
sudo chmod +x /etc/rc.local
# Reboot and verify:
sudo reboot
sudo ipset list
sudo iptables -L -v -nThis project is licensed under the MIT License.
CIDRE was inspired by herrbischoff/country-ip-blocks and aims to provide an automated alternative with firewall integration.
PRs are welcome! Feel free to fork the repo and submit pull requests.
For any questions, open an issue or reach out via GitHub Discussions.