HOWTO: Implement iptables blocking by Country

[biggdog]

I may have misread your last post. After saving the rules to /etc/... I can reboot and have everything saved. My concern is how can we accomplish this through ispconfig?

[ByteMe Networking]

Hey drewb0y,

Thanks for the great stuff. Works like a Charm!

Just one thing though. I went though my logs and found a few countries that were attempting to hack my server or root it so I blocked them.

After the logs cleared up I noticed that ISPConfig 3.0.3 was acting funny. Navigation loading really slow.
Latest news not working at all.
Freshclam not updating.
Things like that.

Well after some investigation I found that ISPConfigs main site and Freshclam all come from Germany.

I had to unblock Germany before ISPConfig would work as it should again.

Just a heads up.

Thanks for the great post,
Casey

[fulltilt]

i'm trying to install but:

http://jengelh.medozas.de/files/geoip/geoip_src.tar.bz2

seems like site is offline ... is there any other download source?

debian squeeze

[trident]

Originally Posted by fulltilt

i'm trying to install but:

http://jengelh.medozas.de/files/geoip/geoip_src.tar.bz2

seems like site is offline ... is there any other download source?

debian squeeze

I failed at this step, too.

I did get nginx geo IP blocking set up, however.

[ByteMe Networking]

The missing link extracts the following code to the geoip_csv_iv0.pl file.
Just create the file above with this code and you should be able to complete this TT.

#!/usr/bin/perl
#
#       Converter for MaxMind CSV database to binary, for xt_geoip
#       Copyright © CC Computer Consultants, 2008
#
#       Contact: Jan Engelhardt <jengelh@computergmbh.de>
#
#       Use -b argument to create big-endian tables.
#
use Getopt::Long;
use IO::Handle;
use Text::CSV_XS; # or trade for Text::CSV
use strict;

my %country;
my %names;
my $csv = Text::CSV_XS->new({binary => 0, eol => $/}); # or Text::CSV
my $mode = "VV";

&Getopt::Long::Configure(qw(bundling));
&GetOptions("b" => sub { $mode = "NN"; });

while (my $row = $csv->getline(*ARGV)) {
        if (!defined($country{$row->[4]})) {
                $country{$row->[4]} = [];
                $names{$row->[4]} = $row->[5];
        }
        my $c = $country{$row->[4]};
        push(@$c, [$row->[2], $row->[3]]);
        if ($. % 4096 == 0) {
                print STDERR "\r\e[2K$. entries";
        }
}

print STDERR "\r\e[2K$. entries total\n";

foreach my $iso_code (sort keys %country) {
        printf "%5u ranges for %s %s\n",
                scalar(@{$country{$iso_code}}),
                $iso_code, $names{$iso_code};

        open(my $fh, ">".uc($iso_code).".iv0");
        foreach my $range (@{$country{$iso_code}}) {
                print $fh pack($mode, $range->[0], $range->[1]);
        }
        close $fh;
}

I could not find my original download of that file but this is all that was in it.

Sorry for the late response.
Hope it helps.

[Hoox]

Thanks alot for this! I got this working using the hint from Casey.
How would I go about blocking everything but one country on a single port? For instance, I want to block access to port 22(ssh) from all countries but Denmark?