From 3e922883f7f97b366ed02b473cbb06ef0d217051 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kry=C5=A1tof=20Pe=C5=A1ek?= <krystof.pesek@gmail.com>
Date: Mon, 18 May 2026 05:07:31 +0200
Subject: [PATCH] drop subnet script

---
 drop | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100755 drop

diff --git a/drop b/drop
new file mode 100755
index 0000000..04cdaa1
--- /dev/null
+++ b/drop
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IP="${1:-}"
+if [[ -z "$IP" ]]; then
+  echo "Usage: $0 <IPv4-address>"
+  exit 2
+fi
+
+# validate basic IPv4 format
+if ! [[ "$IP" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
+  echo "Invalid IPv4 address"
+  exit 2
+fi
+
+IFS='.' read -r o1 o2 o3 o4 <<< "$IP"
+for oct in "$o1" "$o2" "$o3" "$o4"; do
+  if (( oct < 0 || oct > 255 )); then
+    echo "Invalid IPv4 address"
+    exit 2
+  fi
+done
+
+CIDR="${o1}.${o2}.${o3}.0/24"
+echo "CIDR: $CIDR"
+
+# add nftables rule (creates table/chain if missing)
+if ! sudo nft list table ip filter >/dev/null 2>&1; then
+  sudo nft add table ip filter
+fi
+if ! sudo nft list chain ip filter input >/dev/null 2>&1; then
+  sudo nft 'add chain ip filter input { type filter hook input priority 0; }'
+fi
+
+# idempotent: delete existing identical rule if present, then add
+sudo nft -f - <<EOF
+table ip filter {
+  chain input {
+    type filter hook input priority 0;
+    ip saddr $CIDR drop
+  }
+}
+EOF
+
+echo "Added nftables rule to drop traffic from $CIDR"