Date: Mon, 25 Jul 2016 08:47:28 -0700 From: Michael Sierchio <kudzu@tenebras.com> To: "Dr. Rolf Jansen" <rj@cyclaero.com> Cc: freebsd-ipfw@freebsd.org Subject: Re: ipfw divert filter for IPv4 geo-blocking Message-ID: <CAHu1Y739PvFqqEKE74BjzgLa7NNG6Kh55NPnU5MaA-8HsrjkFw@mail.gmail.com> In-Reply-To: <61DFB3E2-6E34-4EEA-8AC6-70094CEACA72@cyclaero.com> References: <61DFB3E2-6E34-4EEA-8AC6-70094CEACA72@cyclaero.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Writing a divert daemon is a praiseworthy project, but I think you could do this without sending packets to user land. You could use tables - in fact, a single table of consolidated nets by country, in which the table entry is a CIDR block and the table arg is a country code - and you match on table arg. You could simply put nets you want to block in a table, and dispense with table args. That is how I do it. In order to do changes atomically, you need a pair of tables and a pair of rulesets, and you can swap rulesets when you have built the new table. On Jul 25, 2016 07:29, "Dr. Rolf Jansen" <rj@cyclaero.com> wrote: > I have written a ipfw divert filter daemon for IPv4 geo-blocking. It is > working flawlessly on two server installations since a week. > > Anyway, I am still in doubt whether I do the blocking in the correct way. > Once the filter receives a packet from the respective divert socket it > looks up the country code of the source IP in the IP-Ranges database, and > if the country code shall be allowed then it returns the unaltered packet > via said socket, otherwise, the filter does no further processing, so the > packet is effectively gone, lost, dropped, discarded, or whatever would be > the correct terminology. Is this the really the correct way of denying a > packet, or is it necessary to inform ipfw somehow about the circumstances, > so it can run a proper dropping procedure? > > I uploaded the filter + accompanying tools to GitHub > > https://github.com/cyclaero/ipdb > > Many thnaks for any advices in advance. > > Best regards > > Rolf > > > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAHu1Y739PvFqqEKE74BjzgLa7NNG6Kh55NPnU5MaA-8HsrjkFw>