OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 17.7 Legacy Series »
  • GeoIP Blocks All Traffic Instead of Per-Country Traffic
« previous next »
  • Print
Pages: [1]

Author Topic: GeoIP Blocks All Traffic Instead of Per-Country Traffic  (Read 6144 times)

rajl

  • Newbie
  • *
  • Posts: 31
  • Karma: 1
    • View Profile
GeoIP Blocks All Traffic Instead of Per-Country Traffic
« on: January 26, 2018, 03:08:15 pm »
This is one of those "I followed the documentation, why doesn't it work" questions.

My problem is that when I enable per-country rules for GeoIP blocking, OPNSense blocks all internet traffic instead of just traffic to the prohibited country.  As a test, I created a rule that blocked all outbound traffic to Russia.  I enabled the rule, I enabled Intrusion Detection, and I enabled IPS mode (all per documentation).  I also double-checked to make sure the rule is on the WAN interface only.  With this rule enabled, the expected behavior is that traffic to Russia is blocked, but traffic anywhere else is permitted.  For example, I should be blocked from accessing www.yandex.ru, but allowed to view www.cnn.com or news.bbc.co.uk.  Instead, all outbound traffic is blocked with this single GeoIP rule enabled.

What am I doing wrong?

Thanks.
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6289
  • Karma: 432
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #1 on: January 26, 2018, 03:48:57 pm »
Do you try with IPS or Alias?

Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

rajl

  • Newbie
  • *
  • Posts: 31
  • Karma: 1
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #2 on: January 26, 2018, 03:58:56 pm »
I tried with IPS following the steps straight from the documentation.
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6289
  • Karma: 432
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #3 on: January 26, 2018, 10:11:31 pm »
Doc is a bit outdated, try with Geo IP alias in Firewall aliases
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

rajl

  • Newbie
  • *
  • Posts: 31
  • Karma: 1
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #4 on: January 27, 2018, 04:24:07 am »
Thanks.

Unfortunately, my country (United States) is missing.  Every other country in the Americas is listed, including the U.S. Virgin Islands.  However, the U.S. itself is missing from the list of countries in the Americas. ::)
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6289
  • Karma: 432
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #5 on: January 27, 2018, 08:52:03 am »
Pacific - United States .. at the bottom
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13624
  • Karma: 1173
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #6 on: January 27, 2018, 01:59:02 pm »
Those fancy countries with their spanning multiple regions...

https://github.com/opnsense/core/commit/7ebd5fcd


Cheers,
Franco
Logged

rajl

  • Newbie
  • *
  • Posts: 31
  • Karma: 1
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #7 on: January 27, 2018, 10:19:01 pm »
Quote from: franco on January 27, 2018, 01:59:02 pm
Those fancy countries with their spanning multiple regions...

https://github.com/opnsense/core/commit/7ebd5fcd


Cheers,
Franco

Yeah, when you don’t follow the ISO assignment for countries to continents, you get some dumb questions like mine. :). You also end up with Russia in Asia and Turkey in Europe (to name a few other odd balls I saw).

EDIT: Correct iPhone Typos
« Last Edit: January 28, 2018, 04:30:30 am by rajl »
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13624
  • Karma: 1173
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #8 on: January 28, 2018, 12:53:16 pm »
We cannot precisely follow ISO 3166 because the most prevalent provider of the codes which is tzdata does not include the Continent Code:

https://github.com/opnsense/core/blob/master/contrib/tzdata/iso3166.tab

So we extrapolate from the zone mapping...

https://github.com/opnsense/core/blob/master/contrib/tzdata/zone.tab

... and that is ambiguous because it maps time zones, not countries.


Cheers,
Franco
Logged

dcol

  • Hero Member
  • *****
  • Posts: 557
  • Karma: 46
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #9 on: January 28, 2018, 09:51:33 pm »
I do a two tier approach. Weeding out the top 10 worst spam countries with IPS, then the rest with GeoIP.
That way IPS can drop the highest traffic offenders before my firewall has to deal with it.
Logged

marjohn56

  • Hero Member
  • *****
  • Posts: 1676
  • Karma: 168
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #10 on: January 28, 2018, 11:36:01 pm »
I use Spam Hero to handle all my inbound, takes the strain off my system, all the mx records point to them and they are not expensive. I use Geo Blocker for almost all countries except the ones I travel to most or need to have open. I've just found a quite useful list I've added as an alias, which is working well. it's in a straight text format so dead easy to import.

http://bl.plonkatronix.com/plonkatronixRBL.txt

Certainly stopped the 'plonker' who kept trying to get into my server.
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

rajl

  • Newbie
  • *
  • Posts: 31
  • Karma: 1
    • View Profile
Re: GeoIP Blocks All Traffic Instead of Per-Country Traffic
« Reply #11 on: January 30, 2018, 05:19:07 pm »
Quote from: franco on January 28, 2018, 12:53:16 pm
We cannot precisely follow ISO 3166 because the most prevalent provider of the codes which is tzdata does not include the Continent Code:

https://github.com/opnsense/core/blob/master/contrib/tzdata/iso3166.tab

So we extrapolate from the zone mapping...

https://github.com/opnsense/core/blob/master/contrib/tzdata/zone.tab

... and that is ambiguous because it maps time zones, not countries.


Cheers,
Franco

 ::) Leave it to ISO to create a standard that no one can follow.

Appreciate the technical explanation.  It makes sense.
Logged

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 17.7 Legacy Series »
  • GeoIP Blocks All Traffic Instead of Per-Country Traffic
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2