Hello Blago Culjak,
a big thanks to you for testing the GeoIP-block feature and sharing your experience with us.
Hello, been testing whole day, but I'm having some major trouble while doing so.
- After enabling GeoIP, don't even select any country, apply rules, I
can't connect to WUI or SSH from RED. At what position are GeoIP rules? Are they overriding rules made by Incoming Firewall Access?
- Can the quick rules made in Firewall -> GeoIP block be visible in
Firewall->Firewall Rules, so we can get a hang of it?
- Seems that ping is working from RED, so you do not block ICMP in
quick rules made in Firewall -> GeoIP?
Firewall rules will be processed rule by rule, chain by chain and the first rule which applies to a packet will be used.
The GEOIPBLOCK chain is located after the ICMPINPUT and the CONNTRACK chain.
This still allows the System to get and response to ICMP packets on the red interface which are required by various services to work in the proper way. Processing the GEOIPBLOCK after the CONNTRACK chain improves the firewall performance significant and allows to receive answer packets for your clients in the internal network zones. Otherwise it would not be possible to access websites or services which are hosted in a country which is selected in the "geoip-block.cgi". This CGI script only provides an easy to setup and globally valid block of incomming traffic to the IPFire system. This can be distinguished as an extra benefit of GeoIP-block and as separate feature.
The GEOIPBLOCK chain finally will be processed before the INPUTFW and REDINPUT chains, which contains all the firewall rules which can be created by using the web user interface.
The massively improvement of GeoIP-block can be found while create new firewall rules by using the "firewall.cgi". Here you can find the counties or previously created country goups and can be selected as "Source" or "Target" for any kind of rules.
The rules which are created here, also will be displayed in the rules overview.
Best regards,
-Stefan
Development mailing list Development@lists.ipfire.org http://lists.ipfire.org/mailman/listinfo/development