Country Ban?

[jrosetto]

I have been looking for a solid solution for country ban through iptables or some other means but haven't found that perfect setup yet.

I was wondering if others were possibly doing the same and could provide some input on their experience with different options.

Fail2ban is busy all day long banning other countries that are hitting my servers. We only do business in the USA so I would love to find a way to only whitelist USA IP's through iptables and block everything else. I am having trouble finding a IP list that is current and getting frequent updates.

Suggestions or other options are appreciated!

 

[iota]

I'm looking for this too. +1

 

[DigitalDaz]

How to Block IPs from Countries using Iptables Geoip Addons

How to block IPs and traffics originating from and destined to a specifc country using geoip and iptables addons in Linux based machine.

linoxide.com

 

[iota]

Exactly what I'm looking for! Thank you @DigitalDaz. I'll give this a shot.

 

[bdmonsey]

I once picked this site up by one of the IT Expo's but i haven't tried it yet, You can try it and let me know how this works

IP-API.com - Geolocation API

Free IP Geolocation API - lookup any IP address

ip-api.com

At the same time, I started using IDT for my international calling, they only allow calls to country that I allow even though it gives me some more calls sometimes from customers that they can't call certain countries and I have to enable it, it still pays this headache vs getting robbed by voip attacks.

Good luck

 

[mat1010]

Have you had a look at voipbl.org? You can also set parameters to whitelist specific countries to avoid false-positives. It helped me a lot to get rid of known networks that try to brute-force our setup.

 

[iota]

@mat1010 Thank you for sharing that! Will give it a shot too. They also offer on their website a form to report IPs that are making attempts on your system (for consideration to be added to the ban list).

 

[roger_roger]

I'm late to the party but I have developed an ACL that I put into my routers that block a lot of the bad guys. You can start off by just blocking some RIPE superblocks. If you want my ACL, just PM me and I'll send it to you.

 

[jrosetto]

Ended up going with voipbl and I have to say I am happy with the results so far.

 

[mcs3ss2]

hey guys

anyone can make an input

What should I put in place of XXXXXXXXX

voipbl[serial=XXXXXXXXXX]

this is for voipbl instructions mentioned above

EDIT - I am using Freeswitch/fusionPBX

 

[trey168]

I had looked awhile back at trying the following: https://linoxide.com/linux-how-to/block-ips-countries-geoip-addons/

I ended up just dropping everything in iptables and only allowing the IPs we own. We are an ISP but do not offer VoIP if customers are not on our network. We are going to spin up some servers in the next few weeks that will need to be accessed from the outside so I'm going to give that link a shot then.

Our publicly visible servers get hammered by China and Russia IPs 24/7, its kind of obnoxious.

 

[gflow]

Will having so many rules in your IPtables using a tool like voipbl cause performance issues?