Date: Thu, 28 Jul 2016 19:48:28 -0700 From: Lee Brown <leeb@ratnaling.org> To: freebsd-ipfw@freebsd.org Subject: Re: ipfw divert filter for IPv4 geo-blocking Message-ID: <CAFPNf59w6BHgDjLNHW=rQckZAFG4gqPHL49vLXiDmMAxVPOcKg@mail.gmail.com> In-Reply-To: <0D3C9016-7A4A-46BA-B35F-3844D07562A8@obsigna.com> References: <61DFB3E2-6E34-4EEA-8AC6-70094CEACA72@cyclaero.com> <CAHu1Y739PvFqqEKE74BjzgLa7NNG6Kh55NPnU5MaA-8HsrjkFw@mail.gmail.com> <4D047727-F7D0-4BEE-BD42-2501F44C9550@obsigna.com> <c2cd797d-66db-8673-af4e-552dfa916a76@freebsd.org> <9641D08A-0501-4AA2-9DF6-D5AFE6CB2975@obsigna.com> <4d76a492-17ae-cbff-f92f-5bbbb1339aad@freebsd.org> <C0CC7001-16FE-40BF-A96A-1FA51A0AFBA7@obsigna.com> <677900fb-c717-743f-fcfe-86b603466e33@freebsd.org> <0D3C9016-7A4A-46BA-B35F-3844D07562A8@obsigna.com>
next in thread | previous in thread | raw e-mail | index | archive | help
That makes sense to me. Your /20 range encompasses 201.222.16.0 - 201.222.31.255. If you want 201.222.20.0-201.222.31.255, you'll need 3 ranges: 201.222.20.0/22 (201.222.20.0-201.222.23.255) 201.222.24.0/22 (201.222.24.0-201.222.27.255) 201.222.28.0/22 (201.222.28.0-201.222.31.255) this <http://www.subnet-calculator.com/cidr.php>; helps :) On Thu, Jul 28, 2016 at 7:21 PM, Dr. Rolf Jansen <rj@obsigna.com> wrote: > > > Am 27.07.2016 um 12:31 schrieb Julian Elischer <julian@freebsd.org>: > > On 27/07/2016 9:36 PM, Dr. Rolf Jansen wrote: > >>> Am 26.07.2016 um 23:03 schrieb Julian Elischer <julian@freebsd.org>: > >>> On 27/07/2016 3:06 AM, Dr. Rolf Jansen wrote: > >>>> There is another tool called geoip , that I uploaded to GitHub, and > that I use for looking up country codes by IP addresses on the command li= ne. > >>>> > >>>> https://github.com/cyclaero/ipdb/blob/master/geoip.c > >>>> > >>>> This one could easily be extended to produce sorted IP ranges per CC > that could be fed into tables of ipfw. I am thinking of adding a command > line option for specifying CC's for which the IP ranges should be exporte= d, > something like: > >>>> > >>>> geoip -e DE:BR:US:IT:FR:ES > >>>> > >>>> And this could print sorted IP-Ranges belonging to the listed > countries. For this purpose, what would be the ideal format for directly > feeding the produced output into ipfw tables? > >>> The format for using tables directly is the same as that used for > routing tables. > >>> =E2=80=A6 > >>> table 5 add 1.1.1.0/32 1000 > >>> =E2=80=A6 > >>> your application becomes an application for configuring the firewall. > >>> (which you do by feeding commands down a pipe to ipfw, which is > started as 'ipfw -q /dev/stdin') > >> I finished adding a second usage form for the geoip tool, namely > generation of ipfw table construction directives filtered by country code= s. > > wow, wonderful! > > > > with that tool, and ipfw tables we have a fully functional geo > blocking/munging solution in about 4 lines of shell script. > > Unfortunately, I finally discovered that ipfw tables as they are, are > unsuitable for the given purpose, because for some reason ipfw mangles > about 20 % of the passed IP address/masklen pairs. > > For example: > > # ipfw table 1 add 201.222.20.0/20 > # ipfw table 1 list > --> 201.222.16.0/20 0 > > $ geoip 201.222.20.1 > --> 201.222.20.1 in 201.222.20.0-201.222.31.255 in BR > > $ geoip 201.222.16.1 > --> 201.222.16.1 in 201.222.16.0-201.222.19.255 in AR > > Effectively, I asked ipfw to add an IP-range of Brazil to table 1, but it > actually added another one which belongs to Argentina. This doesn't make > too much sense, does it? > > For the time being I switched my servers back to geo-blocking with the > divert filter daemon. > > Best regards > > Rolf > > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAFPNf59w6BHgDjLNHW=rQckZAFG4gqPHL49vLXiDmMAxVPOcKg>