From owner-freebsd-net@freebsd.org  Wed Nov 27 05:47:16 2019
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.nyi.freebsd.org (Postfix) with ESMTP id 187591CAE82
 for <freebsd-net@mailman.nyi.freebsd.org>;
 Wed, 27 Nov 2019 05:47:16 +0000 (UTC)
 (envelope-from julian@freebsd.org)
Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "vps1.elischer.org",
 Issuer "CA Cert Signing Authority" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 47N8tC5TwBz3CdK
 for <freebsd-net@FreeBSD.ORG>; Wed, 27 Nov 2019 05:47:15 +0000 (UTC)
 (envelope-from julian@freebsd.org)
Received: from Julian-MBP3.local (c-73-225-95-104.hsd1.wa.comcast.net
 [73.225.95.104]) (authenticated bits=0)
 by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id xAR5l8Fj004848
 (version=TLSv1.2 cipher=AES128-SHA bits=128 verify=NO)
 for <freebsd-net@FreeBSD.ORG>; Tue, 26 Nov 2019 21:47:09 -0800 (PST)
 (envelope-from julian@freebsd.org)
To: "freebsd-net@freebsd.org" <freebsd-net@FreeBSD.ORG>
From: Julian Elischer <julian@freebsd.org>
Subject: geo blocking with ipfw ... the easy way
Message-ID: <9e043ec9-e103-7dea-00b0-cb6af1474a59@freebsd.org>
Date: Tue, 26 Nov 2019 21:47:02 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0)
 Gecko/20100101 Thunderbird/60.9.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
X-Rspamd-Queue-Id: 47N8tC5TwBz3CdK
X-Spamd-Bar: -
Authentication-Results: mx1.freebsd.org;
	none
X-Spamd-Result: default: False [-1.61 / 15.00];
 local_wl_from(0.00)[freebsd.org];
 NEURAL_HAM_MEDIUM(-0.91)[-0.913,0];
 NEURAL_HAM_LONG(-0.70)[-0.700,0];
 ASN(0.00)[asn:36236, ipnet:204.109.60.0/22, country:US]
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Nov 2019 05:47:16 -0000

just in case someone wants to do this:
The following script sets up a table (which can be
used for blocking or allowing) in ipfw so that it holds
nets assigned to the USA and Australia.
You may select your own nets of course:
It uses the ipdbtools package.


(I run this from cron)

#!/bin/sh
ALLOWFILE=/root/AU+USA-GEOIPS.ipfw
MAILTABLE=20
ALT_MAILTABLE=21
AU_VAL=10000
US_VAL=10200
set -x

#fetch latest geo-ip ranges and set AU and USA into table ${MAILTABLE}
ipdb-update.sh
ipup -t AU=${AU_VAL}:US=${US_VAL} -n ${ALT_MAILTABLE} > ${ALLOWFILE}
ipfw table ${ALT_MAILTABLE} flush
ipfw -q -f ${ALLOWFILE}
ipfw table ${MAILTABLE} swap ${ALT_MAILTABLE}