From d78bf24d56c61086e90c3ce13c59955bc50cb4ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Steffen=20M=C3=B6ller?= <steffen_moeller@gmx.de>
Date: Sat, 27 Dec 2014 23:27:27 +0100
Subject: [PATCH] Early failure upon ipset missing blacklist

---
 update-blacklist.sh | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/update-blacklist.sh b/update-blacklist.sh
index 7103967..4ee9f49 100644
--- a/update-blacklist.sh
+++ b/update-blacklist.sh
@@ -1,4 +1,19 @@
 #!/bin/bash
+
+if ! ipset list -name | grep -q 'blacklist$' ; then
+        cat <<EOCAT
+Error: The ipset-based blacklist was not yet defined. Please execute as root:
+
+       ipset create blacklist hash:net
+       iptables -I INPUT -m set --match-set blacklist src -j DROP
+
+A gateway may benefit from the additional line
+
+       iptables -I FORWARD -m set --match-set blacklist src -j DROP
+EOCAT
+        exit 1
+fi
+
 IP_TMP=/tmp/ip.tmp
 IP_BLACKLIST=/etc/ip-blacklist.conf
 IP_BLACKLIST_TMP=/tmp/ip-blacklist.tmp