Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #3041
| From | Moe Trin <ibuprofin@painkiller.example.tld.invalid> |
|---|---|
| Newsgroups | comp.os.linux.networking |
| Subject | Re: Blocking IP addresses from specific countries |
| Date | 2014-07-28 02:32 +0000 |
| Organization | International League of Cat Herders, Local 352 |
| Message-ID | <slrnltbdic.5dl.ibuprofin@fermi.phx.az.us> (permalink) |
| References | <lr3mi8$21g$1@news.albasani.net> |
On Sun, 27 Jul 2014, in the Usenet newsgroup comp.os.linux.networking, in
article <lr3mi8$21g$1@news.albasani.net>, Clark Smith wrote:
> The problem: How to block packets from IP addresses controlled
>by specific countries.
"controlled by"... doesn't exactly compute. There are two sources of
country information. The five Regional Internet Registries (AfriNIC,
APNIC, ARIN, LACNIC and RIPE) allocate or assign address blocks. These
may be assigned to "end users" or allocated to users or National
Internet Registries for further sub-allocation or assignment. The
records of the five RIRs include a "country code", but that code
is the ISO-3166 code of the country (or region) of the organization.
The README file from RIPE (among others) specifically warns
This information also indicates the country where resources were
first allocated or assigned. However it is not intended that the
data be considered as an authoritative statement of the location
where any specific resource may currently be in use.
Therefore using this information for IP to country mapping may
result in inaccuracies and, as a result, in user's confusion in
many cases.
That's somewhat understated. The company I worked for is a "multi-
national", and the "whois" registration data says "New York" in the
USA. A traceroute would show the last identifiable location from the
world (before hitting the firewall) as Santa Clara, California - yet
the sub-net I was on is in Phoenix, Arizona, USA (about 360 miles/600
KM East of Los Angeles), and other sub-nets are in Switzerland, France,
Brazil, Japan, China, and Singapore. Blocks may also be allocated to
ISPs who act as "Local Internet Registries" - meaning they can rent
the IPs to individuals or companies, but few are limited to only
providing service in their own country.
The other method is to look at the hostname, and see if the domain part
includes a (ISO-3166) country code - such as "bbc.uk"... but watch out
for the "vanity" domains like .fm, .ly. or .tv. A number of radio
stations in the US use their call-signs within the .fm (the Federated
States of Micronesia) domain, and some TV stations do the same with the
.tv (Tuvalu) domain. And of course, this also assumes that the network
support people managed to configure the DNS with appropriate PTR
records (many don't - and a DNS lookup returns "NXDOMAIN").
Someone recently suggested using a free lookup service at "ipinfo.io"
but my test lookups there have been less than satisfactory. Also, it
works one IP address at a time - and excluding RFC6890 (Special-Purpose
IP Address Registries) address space, there are 3.702 x 10e9 IPv4
addresses available or in use. Lots of lookups anyone?
>I guess that iptables could be used for the job, if one could get
>lists of such IP addresses.
Yes, but that's more a concept problem. Do you have to offer service
to the entire world? My home network allows incoming connections from
just three blocks (a /22 and two /24s or a total of 1530 addresses)
because I really don't expect authorized users to be connecting from
Kazakhstan, Kenya, Kiribati, Korea, Kuwait or Kyrgyzstan and a lot of
other places either. Lest someone from those countries object, I also
don't allow access from nearly all ISPs in the rest of the world Not
expected == not allowed. As I don't offer mail, web, or ftp service to
anyone - those ports are blocked at the firewall.
>However, I suspect such lists are likely to be unwieldy.
About ten days ago, data from the five RIRs listed 138890 IPv4 networks
with a total of 3578033640 (3.6 billion) addresses. There were also
20234 IPv6 networks with 1.13 x 10e30 addresses. These assignments
and/or allocations are NOT made in a manner for easy filtering.
Everyone bitches about China, so let's take a quick look there (only
looking at IPv4). China had 3992 networks as of 7/15/14 at 22:00 UTC,
from 1.0.1.0/24 to 223.255.252.0/23. Looking only at the first octet of
the IPv4 address, the blocks are in
[euclid RIR.stats]$ zgrep CN APNIC.gz | cut -d' ' -f2 | cut -d'.' -f1 |
sort -n | uniq -c | column
59 1 24 106 40 125 20 175
17 14 42 110 1 134 36 180
32 27 34 111 18 139 29 182
25 36 21 112 13 140 17 183
10 39 44 113 6 144 2 192
90 42 37 114 41 150 557 202
29 43 28 115 7 153 968 203
1 45 56 116 7 157 78 210
17 49 38 117 1 159 45 211
1 54 48 118 1 161 73 218
46 58 77 119 1 162 42 219
35 59 31 120 39 163 17 220
38 60 49 121 1 166 64 221
89 61 37 122 2 167 64 222
75 101 51 123 1 168 32 223
503 103 72 124 12 171
[euclid RIR.stats]$
So why not block all of 1.0.0.0/8 you ask?
[euclid RIR.stats]$ zgrep ' 1\.' APNIC.gz | cut -d' ' -f1 | sort | uniq
-c | column
12 AU 5 IN 2 MY 3 TW
59 CN 9 JP 1 PH 1 VN
3 HK 7 KR 8 TH
[euclid RIR.stats]$
It's called "collateral damage". Other /8s are just as bad:
[euclid RIR.stats]$ zgrep ' 202\.' APNIC.gz | cut -d' ' -f1 | sort |
uniq -c | column
2 AF 284 IN 5 MV 164 SG
1 AS 1 IO 65 MY 138 TH
685 AU 331 JP 6 NC 2 TO
35 BD 11 KH 17 NP 1 TV
9 BN 1 KI 1 NU 40 TW
2 BT 41 KR 858 NZ 1 US
1 CK 6 LA 2 PF 38 VN
557 CN 5 LK 9 PG 2 VU
8 FJ 15 MN 84 PH 2 WS
8 GU 12 MO 50 PK
330 HK 2 MP 1 PW
273 ID 1 MU 2 SB
[euclid RIR.stats]$
and this also leaves the question about MO (Macau), HK (Hong Kong) and
TW (Taiwan) in the air. Do you include them as "part of China"? Oh,
and just for mind-boggling, there are 237 ISO-3166 country codes in use
by the 5 RIRs.
> Suggestions, anyone?
Re-think the problem.
Old guy
Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Blocking IP addresses from specific countries Clark Smith <noaddress@nowhere.net> - 2014-07-27 20:14 +0000
Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 02:32 +0000
Re: Blocking IP addresses from specific countries Jorgen Grahn <grahn+nntp@snipabacken.se> - 2014-07-28 07:13 +0000
Re: Blocking IP addresses from specific countries Andrzej Adam Filip <anfi@onet.eu> - 2014-07-28 09:17 +0200
Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-28 13:17 +0000
Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 17:51 +0000
Re: Blocking IP addresses from specific countries Aleksandar Kuktin <akuktin@gmail.com> - 2014-07-28 19:36 +0000
Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:59 +0000
Re: Blocking IP addresses from specific countries Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2014-07-28 14:23 -0700
Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:57 +0000
Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-29 13:16 +0000
Re: Blocking IP addresses from specific countries Roger Blake <rogblake@iname.invalid> - 2014-07-28 20:55 +0000
Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 02:00 +0000
csiph-web