GeoIP Not Blocking Inbound
-
I'm seeing an issue were pfBlocker isn't bocking IP addresses that should be blocked according to the GeoIP blocking rules. I have a Synology NAS that is open, but I have the autoblock setup to block the IP address after 2 failed login attempts.
Someone has been trying to password spray it for the last few hours, but when looking at the IP addresses, they are all out of the country.
Here is how it's setup:
And here are just a few of the addresses that have been able to successfully try to login to the NAS.
118.140.120.110 (China)
91.6.126.17 (Germany)
175.115.153.172 (South Korea)
121.138.203.128 (South Korea)The rules are at the top of the list, so I'm not sure what is wrong.
-
@Spyderturbo007 as you can see by the 0/0 none of those rules have ever triggered. Do you maybe have floating rule which would be evaluated before the wan rules.
Have the tables populated, look under diagnostics, tables.
Also its better to allow what you want vs try and deny the planet.. I use a rule to only allow US ips for example.
-
@johnpoz Thank you for your help!
No floating rules it seems.
No floating rules are currently defined. Click the button to add a new rule.
The tables are populated and here is a screenshot of the list of tables.
-
It's not clear what the issue could be with the information provided. It's not clear if it's a pfBlockerNG configuration issue or a general firewalling issue (or other). You'll have to reveal more about your setup.
You might start with the interface tabs of your firewall ruleset and pfBlockerNG's relevant auto rule config.
-
@Spyderturbo007 said in GeoIP Not Blocking Inbound:
The tables are populated and here is a screenshot of the list of tables.
and when you pick one of those tables - they have ip entries?
example
-
@Spyderturbo007 A common issue is, one selects the continent but on the page does not select any countries:
You can also do this for certain countries on the IPv4/6 tabs:
Also it is probably more memory/resource intensive to block the entire world, than allow your country. For instance you could set a source on the OpenVPN rule of US IPs, via an Alias Native entry created on the IPv4 tab.
Edit:
-
@SteveITS said in GeoIP Not Blocking Inbound:
Also it is probably more memory/resource intensive to block the entire world, than allow your country.
Even if it wasn't - just easier.. Should I pick every single place that I don't want to allow, or just pick the place(s) I do want.. Just makes no sense to try and block the planet, when you can just allow what you want.. Firewalls are default deny for a reason, not default allow.
Isn't this easier? One simple port forward and only what I want is allowed.
-
@johnpoz said in GeoIP Not Blocking Inbound:
@SteveITS said in GeoIP Not Blocking Inbound:
Also it is probably more memory/resource intensive to block the entire world, than allow your country.
Even if it wasn't - just easier.. Should I pick every single place that I don't want to allow, or just pick the place(s) I do want.. Just makes no sense to try and block the planet, when you can just allow what you want.. Firewalls are default deny for a reason, not default allow.
Isn't this easier? One simple port forward and only what I want is allowed.
I appreciate your response, but that's where I get confused. I have a few ports open, but I guess I don't understand on how to only allow them from US IP addresses. It looks like you created a custom list of addresses named pfB_AllowPfb_v4 addresses and then just changed the source from * to that custom list?
If that's the case, I would need to do some reading on how to create that list.
I guess I should only allow inbound VPN traffic and force the users to connect to the VPN before accessing the internal resources.
-
@Spyderturbo007 See my post above. In the IPv4 section, create a list, set format=GeoIP, and type a country code/name for it to autocomplete for you. You can name the list "US" or "allowed_countries" or whatever you like.
(pfB adds the "pfB_" prefix and "_v4" suffix)
-
@Spyderturbo007 said in GeoIP Not Blocking Inbound:
If that's the case, I would need to do some reading on how to create that list.
SteveITS has it pretty much - for example here is my list.
I use to have Belgium in there as well - since family was living there so they could watch my plex server, but just removed it since they are now in China, and using a vpn into the states anyway.
The other ones there are monitoring services - so they can warn me when my home connection is down, or plex goes down. They are not always from US ips. And then there is one that is how plex knows if your service is available remotely so users can direct connect. Again not always us based IPs, and those lists can change now and then so why they are pulled from sources they provide.
There is also custom area if you scroll down so you can add any specific IPs or network that might not be in the US, etc.
Once you create the alias - just use it in your port forward or rules.. You mention vpn, yes I use it in my vpn rules - I update it if going to travel out of the US, recent trip to Ireland, trip next year to Italy, etc.. I just update the alias to allow for where I will be traveling.
-
@Spyderturbo007 said in GeoIP Not Blocking Inbound:
I guess I don't understand on how to only allow them from US IP addresses
You will understand as soon as IPv6 comes into play
Your wallet will explain it.
You can't create a list or table with all existing IPv6 networks used on the world, as the RAM needed to load these would cost you a fortune.
Instead of filtering at the gate for those who are not allowed to get in, filter for those who are allowed, and refuse the rest. Where 'refuse' is pf's default behavior so nothing to.My own WAN rule collection :
The first rule allows incoming traffic with the classic port 1194 IPv4 UDP filter. The incoming IPv4 must belong to the "pfB_Europe_v4" list which I narrowed down to 'France' only.
Lines 2,3,4 are coming from my dedicated data center based server for NAS syncing. and munin traffic.
5 and 6 are basic ICMP rules.
7 and 8 are my own "shut the door" rules. The hidden rule "9" will do the same thing. -
@SteveITS said in GeoIP Not Blocking Inbound:
@Spyderturbo007 See my post above. In the IPv4 section, create a list, set format=GeoIP, and type a country code/name for it to autocomplete for you. You can name the list "US" or "allowed_countries" or whatever you like.
(pfB adds the "pfB_" prefix and "_v4" suffix)
Thanks @SteveITS does this mehtod of defining a geo ip list still requires us to confiure the maxmind key ?
earlier i was doing it using geo ip > Continetn > select appropriate coutry for creating alias native.Best Regards.
-
@Snailkhan Yes, the free Maxmind account+key is required to be able to download the geographical IP lists/data.
Privacy Policy · Cookie Policy