Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running OpenWrt on my router and I love it. My question is how do I block all china addresses from connecting to my firewall on port 22 in the router? 99.9999% of the unauthorized ssh connections are coming from there.


share|improve this question

migrated from Feb 10 '13 at 0:33

This question came from our site for system and network administrators.

I would also suggest moving ssh to a different higher port as it usually drastically decreases the unauthorized connections – Jure1873 Feb 9 '13 at 21:52
Fuero and Hauke Laging. Thanks for your answers. They are just as right as Daniels and answers the specific answer. Had to check meta to know which one to set as answer.... – Asken Feb 12 '13 at 11:06
up vote 2 down vote accepted

I am not sure if it is a good idea to block the IP addresses of a whole nation, especially a country with a huge number of IPs as China. It will slow down your firewall, and yet it is not that effective. If you insist, here is the list of IPs belonging to China. The best way to secure your ssh server is -

  1. Change the ssh port number to a higher port number
  2. Install tools such as fail2ban , which blocks an IP after a number of failed login attempts.
  3. Use private/public key authentication.

You might find this tutorial useful.

share|improve this answer

Just like you would block anyone else. You need the list of Chinese ip blocks, of course. You can get them e.g. here:

Then you need convert it into the iptables format (unless the list already has this format).

The exact procedure depends of the firewall you use. But in general you will create a new chain ssh and send all accesses to port 22 there. If you have a file containing the addresses in iptables format ( then you may use the shell command

while read network; do
  iptables -A ssh -s "$network" -j DROP
done < china-networks.txt
iptables -A ssh -j ACCEPT

This can be optimized by accepting that you kill a few addresses outside China and combining small networks to bigger networks thus reducing the amount of rules to be checked. This can be done from /etc/firewall.user in case of the UCI firewall.

share|improve this answer

Use ipset for large IP address lists to match against.

Create a set:

ipset -N myset iphash
while read network; do
  ipset -A myset ${network}
done < china-networks.txt

Drop traffic:

iptables -A INPUT -m set --set myset src -j DROP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.