Re: Testing GeoIP based firewall

[Stefan Schantl <stefan.schantl@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2238 bytes --]

Hello Blago Culjak,

a big thanks to you for testing the GeoIP-block feature and sharing your
experience with us.
> Hello, been testing whole day, but I'm having some major trouble while
> doing so.
> 
> 1. After enabling GeoIP, don't even select any country, apply rules, I
> can't connect to WUI or SSH from RED. At what position are GeoIP
> rules? Are they overriding rules made by Incoming Firewall Access?
>  
> 2. Can the quick rules made in Firewall -> GeoIP block be visible in
> Firewall->Firewall Rules, so we can get a hang of it?
> 
> 3. Seems that ping is working from RED, so you do not block ICMP in
> quick rules made in Firewall -> GeoIP?

Firewall rules will be processed rule by rule, chain by chain and the
first rule which applies to a packet will be used.

The GEOIPBLOCK chain is located after the ICMPINPUT and the CONNTRACK
chain.

This still allows the System to get and response to ICMP packets on the
red interface which are required by various services to work in the
proper way. Processing the GEOIPBLOCK after the CONNTRACK chain improves
the firewall performance significant and allows to receive answer
packets for your clients in the internal network zones. Otherwise it
would not be possible to access websites or services which are hosted in
a country which is selected in the "geoip-block.cgi". This CGI script
only provides an easy to setup and globally valid block of incomming
traffic to the IPFire system. This can be distinguished as an extra
benefit of GeoIP-block and as separate feature.

The GEOIPBLOCK chain finally will be processed before the INPUTFW and
REDINPUT chains, which contains all the firewall rules which can be
created by using the web user interface.

The massively improvement of GeoIP-block can be found while create new
firewall rules by using the "firewall.cgi". Here you can find the
counties or previously created country goups and can be selected as
"Source" or "Target" for any kind of rules.

The rules which are created here, also will be displayed in the rules
overview.

Best regards,

-Stefan
>  
> _______________________________________________
> Development mailing list
> Development(a)lists.ipfire.org
> http://lists.ipfire.org/mailman/listinfo/development


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]