GeoIP "GB_rep_v4.txt" list contains my domain ISP

Cabledude

@NogBadTheBad said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

https://talosintelligence.com/reputation_center/

Thank you. I checked:

So the rep is good for the .212 range. But it's still in the block list.
@BBcan177 could you shine a light on this?

johnpoz

@Cabledude the top spammers is not really a feed that only has bad guys in it. Its more of just a built in alias that can have all the IPs of specific countries in it..

You notice those are all just lists of all of countries IPs.

If you want to get email from GB countries - don't use the GB ones in that lists, etc.. For example where is the US on that list - there are for sure lots of spammers coming from US IPs, etc.

There is nothing there for your ISP to get removed from - kind of hard to get your IP removed from the list of IPs used in country X, if your in country X and using those IPs..

as @Bob-Dig stated - its prob not the best "name" for that list ;)

NogBadTheBad

You could still use the same rule but just put an allow rule above it for your ISP subnet or specific address.

Cabledude

@johnpoz Thank you for your explanation. However I don't get it yet. We are using pfBlocker to block unwanted stuff. Why would we want to block reputable domains? What I mean is what is the GeoIP list for if it's not for blocking unwanted stuff?

NogBadTheBad

@Cabledude The Top Spammers list includes the ip ranges allocated to the whole country, the list name is misleading.

You really should have a WAN rule just allowing the inbound traffic from your mail provider, not relying on a huge alias to block unwanted stuff.

johnpoz

@Cabledude It can be used for blocking stuff - if you don't want to get any email from the country of South Korea for example, or Spain or Vietnam.. Doesn't matter what the domain is..

Again its prob not a very good choice of name of the list. Its just a list of countries you can pick to block.. See the other names, Asia, North America, Africa...

This is just a list of Geo IP based lists you could use to block.. It clearly is not inclusive as well.. There are many countries missing to choose from that clearly send lots of spam.. Where is the US in the possible choices as example.

If you just want a list of actual known spammer IPs - then use a feed in your blocking that is listing just known spammers, and not a Geo IP based list, that lists all IPs in a specific Country.

Cabledude

@NogBadTheBad
Do you mean that the list contains all domains currently active in the entire country? If so, would the purpose of that list be to block any connection coming in from that country?
Just trying to learn here really...

johnpoz

@Cabledude said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

all domains currently active in the entire country?

Your confusing "domains" and IPs... I can have domainX.tld using any IP from any country in the world.. This lists is just list of IPs from country X or Y, etc. it has nothing to do with "domain"

edit: for example do you think gmail.com is only using IPs from the US? They have servers all over the globe..

Cabledude

@johnpoz Yes sorry, you're right. I meant to say IP's.
[Edit] actually I was trying to say "IP ranges" /0

NogBadTheBad

@Cabledude said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

@NogBadTheBad
Do you mean that the list contains all domains currently active in the entire country? If so, would the purpose of that list be to block any connection coming in from that country?
Just trying to learn here really...

Where. is the email coming from that is going to your home MailPlus server, from Voxility / your ISP or is it coming from various different locations?

johnpoz

@Cabledude Look in the feeds section of pfblocker, and create a alias you can use to block all the actual known "spammers" doesn't matter what country their IPs are in..

Again - this is not a very good choice of "name" for the list - its just a list of Geo IPs lists that you can choose from in your blocking of say email to your server. If you know you never want to get email from any IP from Russia or China for example.. Be it domainX.tld or domainY.tld

if the server was coming from a Russian IP and you had them selected in this top spammer list, you could block any IP in Russia from talking to your email server, even if was say a gmail.com server..

SteveITS

@johnpoz said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

this is not a very good choice of "name" for the list

That's a huge understatement then. :) I would never have guessed. I've never used it since when we supported on premises mail servers they went through our spam filter first anyway so we only allowed those IPs. But then that makes 3 ways to create geo lists, the other two being either by continent or by GeoIP format type on the IP 4/6 tabs.

FWIW the "rep" lists as I understand it are supposed to be as "represented," for instance an IP from a military base in another country would be "rep." https://dev.maxmind.com/geoip/whats-new-in-geoip2

Cabledude

@NogBadTheBad said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

Where. is the email coming from that is going to your home MailPlus server, from Voxility / your ISP or is it coming from various different locations?

Very good question. When this issue came up I was testing my MailPlus server. I was sending test emails from one of my other email addresses, which happen to have their mail server at the same ISP. Therefore, all test emails do in fact originate from that IP.
But once I'm out of the testing stage, email not sent by myself, but by others, will be coming from other random IP's, possibly all over the globe. And I don't want to block all of those.

Bottom line is I need to disable all GeoIP lists in order to be 100% sure to receive my emails.

johnpoz

@SteveITS yeah military base might be one example of _rep for a country.. Also say the IP range a Embassy is using might be another. My understanding of country_rep was that those IPs are IPs that are that country might not actually reside in that specific country borders geographically..

Cabledude

@johnpoz said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

Again - this is not a very good choice of "name" for the list - its just a list of Geo IPs lists that you can choose from in your blocking of say email to your server. If you know you never want to get email from any IP from Russia or China for example.. Be it domainX.tld or domainY.tld

if the server was coming from a Russian IP and you had them selected in this top spammer list, you could block any IP in Russia from talking to your email server, even if was say a gmail.com server..

Right. The question then is whether or not I can be 100% sure I never want to receive email from those countries. Let's take China. I don't know anyone in China so I could GeoIP block all of China. But what if I'm in a discussion with Synology HQ in Taiwan and they send me an email which gets routed through a chain of Chinese Mail Server hops? If the final hop is still in China I won't get that email delivered.

SteveITS

@Cabledude said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

I need to disable all GeoIP lists in order to be 100% sure to receive my emails

Yes, unfortunately, at least for port 25. Or as I alluded to above, if you use a third party spam filter you only need to allow the spam filter's IPs on your end.

What you probably want are the pfB feeds for Spamhaus, and maybe HoneyPot_Spam and/or the MAIL feeds. (have not used any except Spamhaus (E)DROP)

Cabledude

@SteveITS Yes indeed.
[Edit]
I already have PRI1 enabled which contains Spamhaus_Drop and Spamhaus_eDrop.

[Edit]
However in this (older) topic on Reddit BBcan177 states that he prefers to add those lists to the mail server itself, not to pfSense:
Quote:
BBCan177
3 yr. ago
Dev of pfBlockerNG
In pfBlockerNG-devel, there is a Feeds Tab that has a MAIL IP Group that could help reduce spam.
Would highly recommend adding Spamhaus Zen to your mail server. These are to be used in the Mail server (not pfBlockerNG):
https://www.spamhaus.org/zen/
They also have a Reverse DBL list:
https://www.spamhaus.org/dbl/
This is a good source for other DNSRBL Feeds:
http://multirbl.valli.org/

Cabledude

@johnpoz said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

Again - this is not a very good choice of "name" for the list - its just a list of Geo IPs lists that you can choose from in your blocking of say email to your server. If you know you never want to get email from any IP from Russia or China for example.. Be it domainX.tld or domainY.tld

Well I wanted to be sure so I looked up a random website in Brazil:

Non-authoritative answer:
brasilescola.uol.com.br canonical name = salsa.uol.com.br.
Name: salsa.uol.com.br
Address: 200.147.36.53

This IP is not in the BR list. So the lists certainly don't have a countrywide coverage.

johnpoz

@Cabledude said in GeoIP "GB_rep_v4.txt" list contains my domain ISP:

200.147.36.53

now sure where your looking but that is clearly listed as being in BR.

So max mind shows it

https://www.maxmind.com/en/geoip-demo

You can also use ip info as a check
https://ipinfo.io/

I then created a br alias, and ran an update and then looked in the table.

Maybe your confused by it in a /14 that includes that IP.

200.144.0.0/14 would be all of these addresses = 200.144.0.0 - 200.147.255.255

So yes 200.147.36.53 is included

JonathanLee

You could call your ISP and let them know you need a new IP because your on the blacklist...