GeoIP list no more correct for Belgium.

[jfou1987]

Hello, i'm on 25.10.1_2 business Version.
Today, a road warrior user told me he can't connect anymore to VPN server.
I tried on cellular with the same issue.
I found the problem. It's GeoIP. I only give access to Belgian IP (BE). When disabled, it works again.
The geoip database was updated about 15 minutes ago. In the alias IP list (diagnostic/alias) i cannot found any of my belgian (verified) IP adsresses.
I temporary add a whitelist for my user to let him work. But he's behind a dynamic IP internet connexion. I will add his new IP when change.
Does anyone know if the provider of the business GeoIP list has an issue today ?

[peterq]

Same here, we use geo ip on a lot of firewall rules and notice that ip's from the netherlands are blocked since this afternoon, while the netherlands has been configured to have access through geo ip. Changing this to any (so removing geo filtering) fixed it. So there is definitely something wrong with the geo ip database. we use the latest opnsense business.

[patient0]

What do you get if you query the MaxMind DB for these IPs, using their website: https://www.maxmind.com/en/geoip-web-services-demo .

If you not get the expected country back, the issue would have to be reported to MaxMind.

[sopex8260]

Maxmind or IPinfo? Anyway, this is not an opnsense issue :( It must be reported to the provider.

[meyergru]

AFAIK, the business edition uses IPinfo per default, if not configured otherwise.

[franco]

I've asked IPinfo to take a look. Also make sure the maximum table entries value is not too small.


Cheers,
Franco

[IPinfo]

Hi,

I work for IPinfo.

Please contact our support team at https://ipinfo.io/support. They will need the user's IP address to investigate the issue.

In your message, include the list of IP addresses, please.

— Abdullah | DevRel, IPinfo

[robvdw]

We have the same problem with Belgian IPs. We're using the ipinfo database. The ip addresses show fine in the IPInfo database at ipinfo.io (and on Maxmind for that matter). They are also fine in the ipinfo_lite.csv database downloaded (9784 IPv4 ranges):

Code Select Expand

$ grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}.*Belgium' ipinfo_lite.csv|wc -l
9784
However, the list is truncated to the first 64 lines in the Alias-file in /usr/local/share/GeoIP/alias

Code Select Expand

# wc /usr/local/share/GeoIP/alias/BE-IPv4
      64      64     916 /usr/local/share/GeoIP/alias/BE-IPv4

[jfou1987]

Maxmind or IPinfo? Anyway, this is not an opnsense issue :( It must be reported to the provider.

I already get in touch with Robert at Decisio about that specific issue.

I downloaded the Belgian white liste, it contains almost only IP V6.
Only some V4, but as the list is in alphanumerical order, i can see, nothing more after 5.x.x.x is listed ...

Take a look : https://uploadnow.io/f/Qzn9R5G

[jfou1987]

I've asked IPinfo to take a look. Also make sure the maximum table entries value is not too small.


Cheers,
Franco

Of course, i'm only at 3%

[DEC740airp414user]

AFAIK, the business edition uses IPinfo per default, if not configured otherwise.

i noticed the numbers(addresses) decreased in total by about 10k.    is this the reason why those numbers changed so much?

within the last month.  maybe 2?

[meyergru]

I neither use the business edition nor have I monitored the size of the Ipinfo database over time. I use it with the community edition and for me, it works:

Code Select Expand

# wc /usr/local/share/GeoIP/alias/BE-IPv?
    9736    9736  158563 /usr/local/share/GeoIP/alias/BE-IPv4
   24323   24323  566429 /usr/local/share/GeoIP/alias/BE-IPv6
   34059   34059  724992 total

# fgrep ,BE, ipinfo_lite.csv | wc
  34059   64340 2112133

Seems like there is some kind of extraction process from the Ipinfo CSV that failed to generate all entries, maybe because of a subtle syntax error in the CSV. For example, I find this line inside the CSV:

Code Select Expand

2a14:3d02::/35,Belgium,BE,Europe,EU,AS57234,"LLC ""IT NETWORKS CHAT""",ichatua.com.ua

Note the multiple quotes. Also, there are missing ASNs in some lines. So maybe this is a parsing error within OpnSense code, but probably in the business edition only?

[Monviech (Cedrik)]

Do these steps, first execute:

/usr/local/opnsense/scripts/filter/download_geoip.py

Then go to "Firewall - Aliases" and create a new alias that contains Belgium.
After saving and apply, go to "Firewall - Diagnostics - Aliases" and check the contents of the alias you just created.

[meyergru]

As expected (but with the community edition):

You cannot view this attachment.

[robvdw]

Thanks! The current ipinfo file processes fine and fixes the aliases. I suspect there either was a severely truncated file online yesterday afternoon for a short while, or it contained something that crashed the script that extracts them.

I also noticed that the IPv6 files were not updated yesterday, which would be consistent with some kind of truncated file that only contained IPv4 until 5.something.

File sizes before re-download:

Code Select Expand

-rw-r-----  1 root wheel      288 Jan 20 13:41 BA-IPv4
-rw-r-----  1 root wheel    27668 Jan 19 13:40 BA-IPv6
-rw-r-----  1 root wheel       14 Jan 20 13:41 BB-IPv4
-rw-r-----  1 root wheel    13532 Jan 19 13:40 BB-IPv6
-rw-r-----  1 root wheel       14 Jan 20 13:41 BD-IPv4
-rw-r-----  1 root wheel   116040 Jan 19 13:40 BD-IPv6
-rw-r-----  1 root wheel      916 Jan 20 13:41 BE-IPv4
-rw-r-----  1 root wheel   565784 Jan 19 13:40 BE-IPv6
-rw-r-----  1 root wheel       14 Jan 20 13:41 BF-IPv4
-rw-r-----  1 root wheel    23354 Jan 19 13:40 BF-IPv6
-rw-r-----  1 root wheel     1233 Jan 20 13:41 BG-IPv4
-rw-r-----  1 root wheel   122141 Jan 19 13:40 BG-IPv6

File sizes after re-download:

Code Select Expand

-rw-r-----  1 root wheel     8492 Jan 21 12:49 BA-IPv4
-rw-r-----  1 root wheel    27668 Jan 21 12:49 BA-IPv6
-rw-r-----  1 root wheel     4531 Jan 21 12:49 BB-IPv4
-rw-r-----  1 root wheel    13532 Jan 21 12:49 BB-IPv6
-rw-r-----  1 root wheel    65683 Jan 21 12:49 BD-IPv4
-rw-r-----  1 root wheel   114769 Jan 21 12:49 BD-IPv6
-rw-r-----  1 root wheel   158563 Jan 21 12:49 BE-IPv4
-rw-r-----  1 root wheel   566429 Jan 21 12:49 BE-IPv6
-rw-r-----  1 root wheel     5637 Jan 21 12:49 BF-IPv4
-rw-r-----  1 root wheel    23354 Jan 21 12:49 BF-IPv6
-rw-r-----  1 root wheel   118374 Jan 21 12:49 BG-IPv4
-rw-r-----  1 root wheel   122103 Jan 21 12:49 BG-IPv6