#!/bin/bash
# Create new chains
iptables -N cloudflare-incoming
iptables -N cloudflare-outgoing
ip6tables -N cloudflare-incoming
ip6tables -N cloudflare-outgoing
# IPv4
iptables -I cloudflare-incoming -s 173.245.48.0/20 -j DROP
iptables -I cloudflare-incoming -s 103.21.244.0/22 -j DROP
iptables -I cloudflare-incoming -s 103.22.200.0/22 -j DROP
iptables -I cloudflare-incoming -s 103.31.4.0/22 -j DROP
iptables -I cloudflare-incoming -s 141.101.64.0/18 -j DROP
iptables -I cloudflare-incoming -s 108.162.192.0/18 -j DROP
iptables -I cloudflare-incoming -s 190.93.240.0/20 -j DROP
iptables -I cloudflare-incoming -s 188.114.96.0/20 -j DROP
iptables -I cloudflare-incoming -s 197.234.240.0/22 -j DROP
iptables -I cloudflare-incoming -s 198.41.128.0/17 -j DROP
iptables -I cloudflare-incoming -s 162.158.0.0/15 -j DROP
iptables -I cloudflare-incoming -s 104.16.0.0/12 -j DROP
iptables -I cloudflare-incoming -s 172.64.0.0/13 -j DROP
iptables -I cloudflare-incoming -s 131.0.72.0/22 -j DROP
iptables -I cloudflare-outgoing -d 173.245.48.0/20 -j DROP
iptables -I cloudflare-outgoing -d 103.21.244.0/22 -j DROP
iptables -I cloudflare-outgoing -d 103.22.200.0/22 -j DROP
iptables -I cloudflare-outgoing -d 103.31.4.0/22 -j DROP
iptables -I cloudflare-outgoing -d 141.101.64.0/18 -j DROP
iptables -I cloudflare-outgoing -d 108.162.192.0/18 -j DROP
iptables -I cloudflare-outgoing -d 190.93.240.0/20 -j DROP
iptables -I cloudflare-outgoing -d 188.114.96.0/20 -j DROP
iptables -I cloudflare-outgoing -d 197.234.240.0/22 -j DROP
iptables -I cloudflare-outgoing -d 198.41.128.0/17 -j DROP
iptables -I cloudflare-outgoing -d 162.158.0.0/15 -j DROP
iptables -I cloudflare-outgoing -d 104.16.0.0/12 -j DROP
iptables -I cloudflare-outgoing -d 172.64.0.0/13 -j DROP
iptables -I cloudflare-outgoing -d 131.0.72.0/22 -j DROP
# IPv6
ip6tables -I cloudflare-incoming -s 2400:cb00::/32 -j DROP
ip6tables -I cloudflare-incoming -s 2606:4700::/32 -j DROP
ip6tables -I cloudflare-incoming -s 2803:f800::/32 -j DROP
ip6tables -I cloudflare-incoming -s 2405:b500::/32 -j DROP
ip6tables -I cloudflare-incoming -s 2405:8100::/32 -j DROP
ip6tables -I cloudflare-incoming -s 2a06:98c0::/29 -j DROP
ip6tables -I cloudflare-incoming -s 2c0f:f248::/32 -j DROP
ip6tables -I cloudflare-outgoing -d 2400:cb00::/32 -j DROP
ip6tables -I cloudflare-outgoing -d 2606:4700::/32 -j DROP
ip6tables -I cloudflare-outgoing -d 2803:f800::/32 -j DROP
ip6tables -I cloudflare-outgoing -d 2405:b500::/32 -j DROP
ip6tables -I cloudflare-outgoing -d 2405:8100::/32 -j DROP
ip6tables -I cloudflare-outgoing -d 2a06:98c0::/29 -j DROP
ip6tables -I cloudflare-outgoing -d 2c0f:f248::/32 -j DROP
# Whitelist GitLab.com. But only one way
iptables -I cloudflare-outgoing -d 172.65.251.78 -j ACCEPT
ip6tables -I cloudflare-outgoing -d 2606:4700:90:0:f22e:fbec:5bed:a9b9 -j ACCEPT
iptables -A cloudflare-incoming -j RETURN
iptables -A cloudflare-outgoing -j RETURN
iptables -I INPUT -j cloudflare-incoming
iptables -I OUTPUT -j cloudflare-outgoing