Welcome new users! #4
Replies: 9 comments 23 replies
-
|
Hi @friendly-bits Two questions : I notice ICMP is not working. I geo white listed NZ (so banning all other countries) I cannot ping the server. Is that this shell or standard server functionality? I can ssh in on a different to standard port so it handled that very well. I am wanting to ban all traffic from all countries except NZ and then either forward a set of ports or forward everything from this server to a fixed ip address. The end result is to setup a community minecraft server - which is getting hammered by scum from other countries. Keeping it NZ only keeps the ND kids we run the server for safe. Are there any configurations that allow this? Thanks for the great work, |
Beta Was this translation helpful? Give feedback.
-
|
Hi there @OIITCONZ |
Beta Was this translation helpful? Give feedback.
-
|
As to your second question, I'm not sure what you mean by "forward a set of ports or forward everything" but it sounds like you want to set up a tunnel. geoip-shell doesn't do tunnels but there is plenty of software for this. geoip-shell will not interfere with that software, unless for some reason that software needs to receive traffic from blocked countries. What geoip-shell does is it fetches a list of ip subnets which belong to certain country or countries (in your case NZ), creates an ipset (if using iptables) or nftables set (if using nftables) out of that list, and (in whitelist mode) creates iptables or nftables rules which block all inbound traffic which didn't come from ip addresses included in the set. When installed for all network interfaces rather than a specific WAN network interface, geoip-shell also creates some allow rules in order to not block DHCPv6 and other essential communication (which is non-routable, so should not affect the effectiveness of geoip blocking). Generally, if you need things which should occasionally receive traffic from blocked countries, you would have to either add those countries to the whitelist, or come up with some sort of a workaround, for example here users came up with a workaround to allow letsencrypt to renew certificates (you will probably need to use Google automatic translation): If you have any additional questions about geoip-shell, please feel free to ask. |
Beta Was this translation helpful? Give feedback.
-
|
Also note that the available geoip data is not 100% reliable. In some cases some ip subnets may be listed under one country but actually belong to a different country. This is not frequent but this happens. This is a shortcoming of all geoip blocking, not just geoip-shell. Specifically for NZ, I don't know how many ip subnets are assigned wrong and in which way (either an address in NZ is listed under a different country or an address in a different country appears under NZ). It could be that NZ is not affected at all, or it could be that you will have issues. You will just need to try and see. geoip blocking is very effective for reducing the attack surface despite this shortcoming, however if you need a guarantee that 100% percent of people trying to access your server from NZ are not geoblocked, this guarantee can not be given. |
Beta Was this translation helpful? Give feedback.
-
To clarify this point, geoip-shell creates a firewall rule which will allow the locally running software to make outbound connections to blocked countries and receive response. Only if the software is listening for inbound connection requests (without establishing an outbound connection first) then it will not be able to see it if given request comes from a blocked country. |
Beta Was this translation helpful? Give feedback.
-
|
Basically I am wanting to block all ips from anywhere but NZ.
Then set up rules similar to this :
sudo iptables -A INPUT -m set --match-set nz_ips src -j ACCEPT
sudo iptables -t nat -A PREROUTING -m set --match-set nz_ips src -j DNAT
--to-destination 123.456.789.1
sudo iptables -A FORWARD -d 123.456.789.1 -j ACCEPT
Obviously 123.456.789.1 is not my real destination ip address.
My concern is if i do rule 1 above - I cannot set to only allow NZ ips -
but geoip should be doing that so I can ignore rule 1
Rule 2 - Is where this gets difficult. How do I set a prerouting so only
acceptable ips from an NZ range are routed out by rule 3?
Rule 3 How and where would I set this. My server is an out of the box
Ubuntu LTS 24.04 . I turned off UFW and turned on IPTables.
The iptables rules above are from examples for doing this using iptables
and ipset sources but none of them seemed to work - leaving me unable to
ping out, resolve DNS etc.
Yours lets me do those things so now I am trying to add the forwarding
rules as the final step.
The end goal is only allow minecraft players from NZ to connect to the
server. We are getting hammered by dipsticks from overseas which is
chewing up bandwidth and CPU faster than it should for a small server.
Ideally only ports 4000 - 40010 would be forwarded and all others
dropped (SSH excluded)
This box is a relay / router to stand in front of the minecraft server.
I could run geoshell on the minecraft server but there are other
considerations (like 11 other servers behind the same nat) and some of
them need overseas to connect.
I suspect the best option is put MC on its own box, and run geoip on the
MC box. I would prefer to use a VPS with a wide bandwidth and other
firewalls infront rather than direct to my server.
Thanks for your help and answer.
Shane
Shane Hollis
Outsourced Information Technology Limited
Mob: 022 626 5084
…-- ----
All Outsourced Information Technology Limited's work, sales and
correspondence is covered under our terms of service and privacy
policies found at https://outsourcedit.co.nz/tandc .
Our online invoicing system is found at
https://books.zoho.com/portal/outsourcedinformationtechnolog and
invoices, receipts and quotes can be accessed there.
All goods and services sold are covered under the Sale of Goods Act and
the Consumer Guarantees Act of NZ and will be liable for GST where
applicable.
------ Original Message ------
From "friendly-bits" ***@***.***>
To "friendly-bits/geoip-shell" ***@***.***>
Cc "Secure Log On and Form System" ***@***.***>;
"Mention" ***@***.***>
Date 24/08/2024 8:41:32 pm
Subject Re: [friendly-bits/geoip-shell] Welcome new users! (Discussion
#4)
As to your second question, I'm not sure what you mean by "forward a
set of ports or forward everything" but it sounds like you want to set
up a tunnel. geoip-shell doesn't do tunnels but there is plenty of
software for this. geoip-shell will not interfere with that software,
unless for some reason that software needs to receive traffic from
blocked countries. What geoip-shell does is it fetches a list of ip
subnets which belong to certain country or countries (in your case NZ),
creates an ipset (if using iptables) or nftables set (if using
nftables) out of that list, and (in the whitelist mode) creates
iptables or nftables rules which block all inbound traffic which didn't
come from ip addresses included in the set. When installed for all
network interfaces rather than a specific network interface,
geoip-shell also creates some allow rules in order to not block DHCPv6
and other essential communication (which is non-routable, so should not
affect the effectiveness of geoip blocking).
Generally, if you need things which should occasionally receive traffic
from blocked countries, you would have to either add those countries to
the whitelist, or come up with some sort of a workaround, for example
here users came up with a workaround to allow letsencrypt to renew
certificates (you will probably need to use Google automatic
translation):
https://forum.netcup.de/administration-of-a-server-vserver/vserver-server-kvm-server/18634-geoblocking/
If you have any additional questions about geoip-shell, you are welcome
to ask.
—
Reply to this email directly, view it on GitHub
<#4 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AM7P7INLNJNUTPWQ3XZQGDTZTBBLZAVCNFSM6AAAAABNBHSZRKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANBTGY3DMOA>.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Hi, did you manage to achieve the config you wanted? I posted some replies below which I'm not sure you've seen. |
Beta Was this translation helpful? Give feedback.
-
|
First off, you should probably get acquainted with netfiler hooks: (this is from the nftables wiki but the netfilter kernel infrastructure is used by iptables as well) geoip-shell creates rules attached to the This means that geoip blocking is done before any routing decisions about the ingress traffic are made. In other words, traffic from geoblocked countries will not reach table nat where your second rule is located. So with geoip-shell, you don't need the Now correct me if I'm wrong but it sounds like you actually want to geoblock only traffic arriving on some specific ports and let all the other traffic reach its destination. You can do this with geoip-shell: read NOTES.md, sections 9-11. Last but not least please run |
Beta Was this translation helpful? Give feedback.
-
|
You can also read this for more information on how packets traverse tables and chains with iptables: |
Beta Was this translation helpful? Give feedback.
-
|
Sorry, for some reason the links to NOTES.md didn't work in the above answer, fixed now. |
Beta Was this translation helpful? Give feedback.
-
|
I may not have answered all of your questions directly but I hope that with the above information, you can come up with the specific solution you need. If you still need more help after you have processed that information, feel free to ask. |
Beta Was this translation helpful? Give feedback.
-
|
Hi,
Yes - I saw the replies.
No - Not achieved yet. I had a client whose system went down ( gotta
love electricians cutting cables) so had to put this on pause until this
afternoon.
I'll let you know how it goes.
Thanks you. I see you are well named friendly-bits.
BTW : Do you have a donate link? Buy you a coffee or two?
Shane
…Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
No need really for a coffee but you can give the repo a star if you fancy. |
Beta Was this translation helpful? Give feedback.
-
|
Hello. Debian 12.
|
Beta Was this translation helpful? Give feedback.
-
|
After some investigation, the error: |
Beta Was this translation helpful? Give feedback.
-
|
Indeed, turns out that nftables wiki says the set name must be 16 characters or less: Which is weird because geoip-shell creates sets with 31 characters-long names and this works just fine on all systems I've tested with (Debian, Linux Mint, Gentoo, OpenWrt). Perhaps there is some obscure kernel compile-time option which can be set to enforce this and most distros don't set it. Current set names format is kinda ingrained in the geoip-shell code, so quite a bit of modification will be necessary. I'll make an experimental branch which will implement shorter set names. |
Beta Was this translation helpful? Give feedback.
-
|
The experimental branch is here:
Please test with it and let me know if the issue is fixed. |
Beta Was this translation helpful? Give feedback.
-
|
Working perfectly now |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for reporting this and helping me identify the issue. The fix is now incorporated in v0.5.9. |
Beta Was this translation helpful? Give feedback.
-
|
Hello Anton, After some years of not having the need, I researched into Geoblocking again and – after sifting through quite some outdated stuff – luckily stumbled upon your scripts. Within a few minutes, Keep up the good work! |
Beta Was this translation helpful? Give feedback.
-
|
Hi Uwe and thank you for sharing your experience. This kind of responses makes it worthwhile to do open source development. |
Beta Was this translation helpful? Give feedback.
-
|
Hey friendly-bits, I also wanted to say a quick thank you! I've been running a public endpoint for my homelab and wanted to restrict the access to my home country only. I looked into a custom nginx setup, then bunkerweb and while those worked, they only covered the HTTP(s) ports. Then I found your project on reddit, that protects the whole server, including SSH and the setup is super simple! Loving it so far! |
Beta Was this translation helpful? Give feedback.
-
|
Hi, thanks for this nice review. Glad geoip-shell is useful to you. |
Beta Was this translation helpful? Give feedback.
-
|
Of course i read your welcome post! So.. I'm since close to 3 weeks under heavy attack of botnet(s) and the guys are giving me no sleep. Using MANY thousands of single IPs and over a thousand IP-ranges. Don't know why they think it's worth their time so much... Held up well for these weeks but my fail2ban block-lists became so large it started interfering with proper functioning of the server(s), f2b can hardly keep up and not all connects provoke errors to react on. Needed a different approach, geo-blocking seemed obvious but hard to find a decent option. Luckily stumbled upon your repo and decided to give it a go. Worried about interference with my other firewall related measures and (over)complicated setup, some NAT-guests behind hypervisor, some direct on WAN bridge, 2 web servers, 1 mail server, a panel, a docker host, internal virtual local nets, The Works... All for community and non-profit projects. Started using Geoip-shell carefully today and for now not having any issues besides my lips cramping from my constant smile... Might even catch some sleep this night! Your coffee and beer is standing in front of me, come drink it with me my man !! |
Beta Was this translation helpful? Give feedback.
-
|
Great to hear that this little project helped you with what sounds like a nightmare. I started working on it mainly to stop the bot scanning and never imagined that it would be used to stop a targeted botnet attack. I also have to say that depending on the resources and determination of the attackers, geoblocking may turn out to only provide a temporary relief, till the attackers figure it out and adapt. About avoiding interference with your services: geoip-shell supports specifying trusted ip's or subnets which will be excluded from the filter. If having any trouble, you may need to figure out which ip's should be allowed and use that geoip-shell option. Depending on the situation, you might also need to exclude certain ports from geoblocking, which is supported by geoip-shell as well. I appreciate the invitation for coffee/beer. However we are statistically unlikely to be even in the same geographical region (I live in a small country which I don't really want to publicly disclose). So I have to decline. I also currently don't accept donations. But I do appreciate the attitude. Please do keep me posted on how it goes with the whole attack situation. |
Beta Was this translation helpful? Give feedback.
-
|
I'll open up my own thread and explain my setup and use case so we can go into the specifics of how it could hinder (or not) my other defenses and rule chains. For now Asia and Brazil are the origin of all the zombies (not scattered all over the world). Yep, that is a bit strange, i feel it is almost a personal vendetta with the way the resources are used and the attack is coordinated, my servers are kind of insignificant also.. It's not a DDOS but a brute force on all services. Will have time for this in a few days i hope... CU Later..! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Probably barely anybody reads this but for those who do: Lately I've been noticing that this repository is starting to attract some (positive) attention and I see that people are downloading and using this project, which I'm happy about. You are always welcome to ask questions or to ask for additional features (or report bugs if any).
At this occasion I'll also mention that the next release should be coming soon'ish, which features support for additional shells (ksh93 and yash), more robust compatibility checks, improved reliability and some security improvements as well. Keep posted.
Beta Was this translation helpful? Give feedback.
All reactions