#!/bin/sh
BLOCKED_IPS_FILE="/root/blocked_ips.txt"
IPS=""
while IFS= read -r line; do
    if [[ -n "$line" && "$line" != \#* ]]; then
        if [[ -z "$IPS" ]]; then
            IPS="$line"
        else
            IPS="$IPS, $line"
        fi
    fi
done < "$BLOCKED_IPS_FILE"
TEMP_FILE=$(mktemp)
cat <<EOF > $TEMP_FILE
table ip filter {
    chain input {
        type filter hook input priority 0; policy accept;
        iif "lo" accept
        ip saddr { $IPS } numgen random mod 100 < 50 drop
    }
}
EOF
# 执行nftables规则
/usr/sbin/nft -f $TEMP_FILE
# 删除临时文件
rm $TEMP_FILE

#!/bin/sh
RULE_HANDLES=$(nft --handle list table ip filter | grep -E 'ip saddr ([{} 0-9.,]+) numgen random mod 100 < [0-9]+ drop' | grep handle | awk '{print $NF}')
if [ -z "$RULE_HANDLES" ]; then
    echo "cannot find any rules"
else
    # 删除每个找到的规则句柄
    for HANDLE in $RULE_HANDLES; do
        sudo nft delete rule ip filter input handle $HANDLE
        echo "del: $HANDLE"
    done
fi

nft add table ip filter
nft add chain ip filter input { type filter hook input priority 0 \; }
nft add rule ip filter input ip protocol tcp ct state new, untracked meter ratemeter { ip saddr timeout 5m limit rate over 10/minute } drop

#!/usr/sbin/nft -f
table ip my_table {
    chain prerouting {
        type filter hook prerouting priority 0; policy accept;
        ip saddr 192.168.1.100 meta mark set 1
    }
}