Hello, I'm searching for the best way to block IPs by country. Any suggestions to get this working with openwrt. Thanks Christian

banip has option for that. [image] banIP support thread Community Builds, Projects & Packages Hi, in OpenWrt snapshot package repo you'll find the banIP package: stable OpenWrt version 23.05.x.: banIP 0.9.3-4 plus luci companion package latest snapshot version: banIP 0…

I discovered geo blocking is pretty inaccurate, even though I used the latest DBs, and started blocking all + white list of ISP ranges I would allow.

thanks@trendy I'll take a look @frollic it may be inaccurate, I'm using Maxminds GeoIP Database on another server with nginx and had no problems so far. In my oppion its better and more secure to filter prox. about 90% percent of the ips on this world for my services than not.... in addition to the…

I used the same DB, updating it on a weekly basis. I had the lists injected into my shorewall firewall, and noticed (mainly) IPs originating from CN wouldn't get blocked, since the DB wasn't accurate (or updated ?) enough. Using some other lookup tool/site like ipinfo.io , confirmed the IP locatio…

like i said better block than not block. i, for my personal needs, will block all and whitelist a few countries so the hope that they're more accurate is higher.... i had a quickview on banIP but it seems its not precompiled in snapshot i use (bpi-r3). there are easier way?

[image] frollic: But I agree, it's better than nothing. I heartily disagree, geoIP is fundamentally just a heuristic and one that fails relatively often. That might be OK if you need to convince your content providers that you only serve a specific region of the world and hence do not need to…

[image] moeller0: I heartily disagree, geoIP is fundamentally just a heuristic and one that fails relatively often I thought I just said the same ? :wink: [image] moeller0: Personally, I would rather look at fail2ban or similar solutions that are based on suspect behaviour instead of sus…

[image] frollic: I thought I just said the same ? :wink: Sorry, I was reading too much endorsement into your "better than nothing"....

[image] frollic: Eventually I just blocked everything, and put up a narrow white list :slight_smile: That works well, if you can control the IPs of your intended remote end-devices...

Thanks for answers. F2b alone is just additional for sure but with ipinfo.io and all queried this locks really promising. and like i said geoblocking cant be the one but blocking that amount is a beginning for my demands. i won't serve customers from different locations. i only serve me with best se…

OpenWrt Geoblocking

Installing and Using OpenWrt

trendy February 1, 2023, 7:12am 2

banip has option for that.