Блокируем определенные адреса тарифу

mkdir -p  /var/mikbill/scripts

cd  /var/mikbill/scripts

nano ipset.sh

#!/bin/bash
IPSETNAME="gidbase"
IPSET=`which ipset`
HOME_DIR=$(cd $(dirname $0)&& pwd)
mysql -u ipset -pPASSWORD -h 10.10.10.10 mikbill -e "SELECT local_ip FROM users WHERE gid=24;" -s -N > $HOME_DIR/iplist.txt
RESULT=$(cat $HOME_DIR/iplist.txt)
$IPSET -N $IPSETNAME iphash -exist
$IPSET flush $IPSETNAME
for row_data in $RESULT;
do ipset -exist add $IPSETNAME ${row_data};
done
rm iplist.txt
$HOME_DIR/address.sh

chmod +x ipset.sh

nano address.sh

#!/bin/bash
#Client DNS
DNS1=8.8.8.8
DNS2=8.8.4.4
DNS3=195.88.158.8
DNS4=195.88.158.1
DIG=`which dig`
IPSET=`which ipset`
IPSETNAME="address"
HOME_DIR=$(cd $(dirname $0)&& pwd)
SRCDATA=`cat $HOME_DIR/domains.list`
IPLIST="$HOME_DIR/ip.list"
RESULT="$HOME_DIR/paysys.txt"
$DIG +short $SRCDATA @$DNS1 |grep '\([[:digit:]]\{1,3\}\.\)\{3\}[[:digit:]]\{1,3\}' > $RESULT
$DIG +short $SRCDATA @$DNS2 |grep '\([[:digit:]]\{1,3\}\.\)\{3\}[[:digit:]]\{1,3\}' >> $RESULT
$DIG +short $SRCDATA @$DNS3 |grep '\([[:digit:]]\{1,3\}\.\)\{3\}[[:digit:]]\{1,3\}' >> $RESULT
$DIG +short $SRCDATA @$DNS4 |grep '\([[:digit:]]\{1,3\}\.\)\{3\}[[:digit:]]\{1,3\}' >> $RESULT
cat $IPLIST >> $RESULT
$IPSET -N $IPSETNAME iphash -exist
$IPSET flush $IPSETNAME
for i in `cat $RESULT`;
do
$IPSET add $IPSETNAME $i -exist 2>/dev/null;
done

chmod +x address.sh

nano domains.list

Сюда добавляем домены для блокировки

iptables

   # Запрещаем доступ тарифу

    ipset -N gidbase iphash -exist

    ipset -N address iphash -exist

    $IPT -A FORWARD -m set --match-set gidbase src -m set --match-set address dst -j DROP

Cron

0-59/5 * * * * root /var/mikbill/scripts/ipset.sh > /dev/null