Date: Wed, 27 Jul 2016 18:15:33 -0300 From: "Dr. Rolf Jansen" <rj@obsigna.com> To: freebsd-ipfw@freebsd.org Cc: olli hauer <ohauer@gmx.de> Subject: Re: ipfw divert filter for IPv4 geo-blocking Message-ID: <F4646E16-CC07-4711-AFB0-149E8C1EBB53@obsigna.com> In-Reply-To: <d9a33781-9ffd-3c27-c7d6-5e3ac0a82a63@gmx.de> References: <61DFB3E2-6E34-4EEA-8AC6-70094CEACA72@cyclaero.com> <CAHu1Y739PvFqqEKE74BjzgLa7NNG6Kh55NPnU5MaA-8HsrjkFw@mail.gmail.com> <4D047727-F7D0-4BEE-BD42-2501F44C9550@obsigna.com> <c2cd797d-66db-8673-af4e-552dfa916a76@freebsd.org> <9641D08A-0501-4AA2-9DF6-D5AFE6CB2975@obsigna.com> <4d76a492-17ae-cbff-f92f-5bbbb1339aad@freebsd.org> <C0CC7001-16FE-40BF-A96A-1FA51A0AFBA7@obsigna.com> <d9a33781-9ffd-3c27-c7d6-5e3ac0a82a63@gmx.de>
next in thread | previous in thread | raw e-mail | index | archive | help
> Am 27.07.2016 um 17:08 schrieb olli hauer <ohauer@gmx.de>:
> On 2016-07-27 15:36, Dr. Rolf Jansen wrote:
>>=20
>> I finished adding a second usage form for the geoip tool, namely =
generation of ipfw table construction directives filtered by country =
codes.
>>=20
>> ______________
>> $ geoip -h
>> geoip v1.0.1 (16), Copyright =C2=A9 2016 Dr. Rolf Jansen
>>=20
>> Usage:
>>=20
>> 1) look-up the country code belonging to an IPv4 address given by the =
last command line argument:
>>=20
>> geoip [-r bstfile] [-h] <dotted IPv4 address>
>> <IPv4 address> a dotted IPv4 address to be looked-up.
>>=20
>> 2) generate a sorted list of IPv4 address/masklen pairs per country =
code, formatted as ipfw table construction directives:
>>=20
>> geoip -t [CC:DD:EE:..] [-n table number] [-v table value] [-r =
bstfile] [-h]
>>=20
>> -t [CC:DD:EE:..] output all IPv4 address/masklen pairs =
belonging to the listed countries, given by 2 letter
>> capital country codes, separated by colon. An =
empty CC list means any country code.
>> -n table number the ipfw table number between 0 and 65534 =
[default: 0].
>> -v table value the 32-bit unsigned value of the ipfw table =
entry [default: 0].
>>=20
>> valid arguments in both usage forms:
>>=20
>> -r bstfile the path to the binary file with the =
consolidated IP ranges that has been.
>> generated by the 'ipdb' tool [default: =
/usr/local/etc/ipdb/IPRanges/ipcc.bst].
>> -h show these usage instructions.
>> ______________
>>=20
>> With that, the ipfw configuration script may contain something alike:
>>=20
>> =E2=80=A6
>> # allow only web access from DE, BR, US:
>> /usr/local/bin/geoip -t DE:BR:US -n 7 | /sbin/ipfw -q /dev/stdin
>> /sbin/ipfw -q add 70 deny tcp from not table\(7\) to any 80,443 in =
recv WAN_if setup
>> =E2=80=A6
>>=20
>> OR, the other way around:
>> =E2=80=A6
>> # deny web access from certain disgraceful regions:
>> /usr/local/bin/geoip -t KO:TR:SA:RU:GB -n 66 | /sbin/ipfw -q =
/dev/stdin
>> /sbin/ipfw -q add 70 allow tcp from not table\(66\) to any 80,443 =
in recv WAN_if setup
>> =E2=80=A6
>> ____________
>=20
> Nice work :)
>=20
> Now it is also possible to use geoip to create files usable for pf.
> (just pipe the output through sed -e 's/table 0 add //')
>=20
> Perhaps the following diff for Makefile is useful.
> - use PREFIX instead hard coded path
> - use "install -s" instead "strip -x -o"
> - use "install -m" instead "cp ; chmod"
I changed the Makefile according to your suggestions, and I added =
another command line option to the geoip tool:
=E2=80=A6
-p plain IP table generation, i.e. without ipfw construction =
directives, -n and -v flags are ignored.
=E2=80=A6
The changes are already uploaded to GitHub.
Best regards
Rolf
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?F4646E16-CC07-4711-AFB0-149E8C1EBB53>