Defeating Proxy Networks and Botnets at the Kernel Level

🛡️ Defeating Proxy Networks and Botnets at the Kernel Level:

An Ubuntu Security Guide

When an aggressive proxy provider or scraper attacks your infrastructure with thousands of rotating IP addresses, software-level blocking (like WordPress security plugins or individual firewall rules) is completely useless. Distributed networks rent out entire Autonomous Systems (ASNs), changing their IP address every second.The Solution: Instead of chasing individual IPs, we block the attacker’s entire Autonomous System (ASN 200373) directly inside the Linux kernel using iptables and ipset. This drops the malicious traffic before it can waste even a single percent of your CPU or web server resources.This step-by-step production guide is optimized for Ubuntu Server (tested on Ubuntu 24.04) and utilizes a daily automation via systemd timers to query live global routing tables.

📋 1. Install the Core Dependencies

We install the official whois tool to query the global routing registries and ipset to manage thousands of IP networks efficiently in the system memory.

sudo apt-get update && sudo apt-get install whois ipset -y

⚙️ 2. Initialize the IPset and Firewall Chain

We create a dynamic kernel-level list and inject the DROP rule at the very top of iptables (position 1). This ensures the traffic is killed before it reaches sshd, Apache, Nginx, or PHP.

sudo ipset create block_3xk hash:net
sudo iptables -I INPUT 1 -m set --match-set block_3xk src -j DROP

Note: Make sure to freeze your active firewall configuration afterward using your local utility (e.g., sudo iptables-save > /etc/iptables/rules.v4 or sudo netfilter-persistent save) so the iptables hook survives a server reboot.

📝 3. Create the Dynamic Automation Script

Instead of relying on unstable third-party websites or fragile GitHub scrapers, we fetch the live routing blocks straight from the official source: the RADB Routing Registry.Create the update script at

/usr/local/bin/update-3xk-block.sh:

#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# The official Autonomous System Number of the attacking network
ASN="AS200373"

# Ensure the main ipset exists
ipset create block_3xk hash:net -exist

# Query RADB live, extract all active IPv4 prefixes, and inject them directly
whois -h whois.radb.net -- "-i origin $ASN" | grep "^route:" | awk '{print $2}' | while read -r range; do
    if [[ -n "$range" ]]; then
        ipset add block_3xk "$range" -exist
    fi
done

Make the script executable:

sudo chmod +x /usr/local/bin/update-3xk-block.sh

⏱️ 4. Set Up Systemd Automation (Every Night at 03:00 AM)

Standard cronjobs frequently fail in minimal environment contexts due to restricted paths. Native systemd timers are the modern, rock-solid alternative for enterprise automation.

A) Create the Service File (/etc/systemd/system/update-3xk.service):

[Unit]
Description=Update 3xK Tech GmbH IPset Blocklist
After=network.target

[Service]
Type=oneshot
ExecStart=/bin/bash /usr/local/bin/update-3xk-block.sh

B) Create the Timer File (/etc/systemd/system/update-3xk.timer):

[Unit]
Description=Run 3xK Tech Update daily at 3am

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

C) Reload and Enable the Systemd Lifecycle:

sudo systemctl daemon-reload
sudo systemctl enable --now update-3xk.timer
sudo systemctl start update-3xk.service

📊 5. Verifying the Kernel State

Execute this check to see exactly how many global network infrastructure blocks your kernel is vaporizing in real time:

sudo ipset list block_3xk | grep -E 'Name:|Number of entries:'

Live Output: Number of entries: 208

💡 Summary

While third-party blocklists only reported a handful of subnets for this network, tapping directly into the official RADB register unmasked 208 global network blocks. By offloading this threat straight to the Linux kernel, the attack vector is completely closed, leaving web logs clean and resource usage flat.