block_ips.py

import os


def get_connected_ips():
    ips = os.popen("netstat -tn 2>/dev/null | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head")

    x = ips.read()
    x = x.replace("\n", " ")
    x=x.split(" ")

    ip_addresses = []
    for i in x:
        if len(i) > 3:
            ip_addresses.append(i)

    return ip_addresses

def run():
    to_block = []
    cur_connected = get_connected_ips()
    for ip in cur_connected:
        if not ip in to_block:
            to_block.append(ip)
    return to_block

if __name__ == "__main__":
    try:
        blocked = []
        while True:
            try:
                blocking = run()
                for ip in blocking:
                    if ip not in blocked:
                        os.system("iptables -I FORWARD -s %s/24 -j DROP"%ip)
                        blocked.append(ip)

            except KeyboardInterrupt:
                os.system("iptables-save | awk ' !x[$0]++' | iptables-restore")
                out = os.popen("iptables -L")
                print(out.read())
                break
    except:
        raise