GEOIP stopt working

[chemlud]

I have two floating rules on all interfaces, one with GeoIP as SOURCE, one with DESTINATION. But I checked now, only the one with SOURCE does fire, if I try to access yandex.ru in the browser. My expectation was that even the traffic from the LAN client (GeoIP as DESTINATION) would be blocked...

Can someone of the network nerds please comment on this? Where is my mistake in this line of thought? :-)

PS: I created additional block rules on LAN with GeoIP Alias as DESTINATION, but these also do not fire when I try to contact hosts in the blocked regions. But the browser times out while attempting to reach hosts.

[mimugmail]

Transparent Proxy?

[chemlud]

Nope, plain vanilla:

cabel modem (bridged) - DHCPv4 as WAN on OPNsense (latest x64) - LAN (10.10.10.0/25)

Only thing runnning is Suricata with some rules, but I don't see anything in the Suricata logs...

PS: I did a pcap on the LAN interface and see two outgoing SYN packages to 77.88.55.55 (yandex.ru) when trying to browse yandex.ru and 4 retransmissions. Browser times out, but nothing in the life view for the FW logs (filter for 77.88.55.55).

[dcol]

Would be nice if someone could post some GeoIP example rules.

I did seem to get it working, but I think my rules could be cleaner. Since floating rules don't include the local IP's, I have to have a rules for all the local nets before the GeoIP rules. Would be nice to include my own IP list into the Maxmind one.

I have to do this because my GeoIP rule is set to block all counties except US using an invert. See attached.
Is there a better way to handle this?

[chemlud]

Fun fact: I can't reproduce the non-logging issue for the GeoIP rule on a second machine with same OPNsense version, but the geoip Alias FRESH defined AFTER activating the account.

Would have to delete all geoip rules, delete the geoip Alias, create a fresh Alias and rules and see how logging works then. But too busy currently...

[enor]

I have aswell problems with geoip.

I have done a fresh install of my opnsense router. So I am at OPNsense 19.7.9_1-amd64

I have this url and when I paste it in a browser I get a ZIP file.
https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country-CSV&license_key=MYKEY&suffix=zip

I have deleted old alias and created a new geopip alias. When hitting apply I get "In order to use GeoIP, you need to configure a source in the GeoIP settings tab"

The MaxmInd option I choose when generating key are
Will this key be used for GeoIP Update? : YES
[CHECK] Generate a license key and config file for use with geopipupdate version 3.1.1 or newer. 

[marjohn56]

You should be able to paste that whole URL into a browser and it should download the zip file.. does it?

[enor]

You should be able to paste that whole URL into a browser and it should download the zip file.. does it?

Yes as I wrote. When I paste it in a webbrowser a zip file is downloaded.

Zipfilename: GeoLite2-Country-CSV_20200121.zip
GeoLite2-Country-CSV_20200121
├── COPYRIGHT.txt
├── GeoLite2-Country-Blocks-IPv4.csv
├── GeoLite2-Country-Blocks-IPv6.csv
├── GeoLite2-Country-Locations-de.csv
├── GeoLite2-Country-Locations-en.csv
├── GeoLite2-Country-Locations-es.csv
├── GeoLite2-Country-Locations-fr.csv
├── GeoLite2-Country-Locations-ja.csv
├── GeoLite2-Country-Locations-pt-BR.csv
├── GeoLite2-Country-Locations-ru.csv
├── GeoLite2-Country-Locations-zh-CN.csv
├── LICENSE.txt
└── README.txt


I tried the recommended way to force download with recommended python 3 way but it immediately exited with:
{'address_count': 0, 'file_count': 0, 'timestamp': None, 'locations_filename': None, 'address_sources': {'IPv4': None, 'IPv6': None}}


Hmm Noticed that I get "invalid license key" in curl/other browsers where I didn't sign up for maxmind login.

[enor]

Hmm.
Well generated a new Key at Maxmind but chose NO on "Will this key be used for GeoIP Update? " when generating key.

Which works for me now.

[marjohn56]

OK.. Think we need to change the docs again and advise to select no when selecting the licence type.

[opnsenseuser]

OK.. Think we need to change the docs again and advise to select no when selecting the licence type.

have the same problem but selecting "no" when i asked "Will this key be used for GeoIP Update?" doesn´t work for me.
the link itself works but not for opnsense. it always asked me to fill in the url which i did. but no success.

[marjohn56]

Take the url and use curl in the shell

curl -v url


see what happens.

[opnsenseuser]

Take the url and use curl in the shell

curl -v url


see what happens.

in the router shell i get an error: license_key=xxxxxxxxxxx: Command not found.

[opnsenseuser]

added a screenshot for more details

[marjohn56]

Look like curl is not installed. Just type curl, do you get a help prompt?


If not pkg install curl