Only allow US ip addresses

jonfa · 03-08-2007, 04:52 PM

Hi All,

If I wanted to Block every ip address except those from the United States how can I do this with iptables?

Can I do something like this:

/sbin/iptables -I INPUT -s IPADDRESS/SUBNET -j ACCEPT

My question is I want to block every IP address that I do not specify and only allow those I do specify.

Thanks.

Capt_Caveman · 03-08-2007, 06:45 PM

Sure. The easiest way is to add rules for the systems you want to allow and then use a rule at the end to drop everything else that isn't matched (or just make your default INPUT policy DROP or REJECT. So to give you an example, if I want to allow 192.168.0.1 and the range 10.10.10.0-10.10.10.255 I'd use:

Code:

iptables -A INPUT -s 192.168.0.1/32 -j ACCEPT
iptables -A INPUT -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -j REJECT

or alternatively:

Code:

iptables -P INPUT REJECT
iptables -A INPUT -s 192.168.0.1/32 -j ACCEPT
iptables -A INPUT -s 10.10.10.0/24 -j ACCEPT

Those are obviously rudimentary examples and you'll need more rules for a functioning firewall. If you want to allow just the U.S. that might be a bit more tricky, specifically finding a list of which IPs are specific to the US. I think I've seen similar lists like that before but I don't remember where. You may have some luck on google though.

win32sux · 03-08-2007, 07:50 PM

or you could use iptables' geoip match module... from man iptables:

Code:

geoip
       Match a packet by its source or destination country.

       [!] --src-cc, --source-country country[,country,country,...]
              Match packet coming from (one of) the specified country(ies)

       [!] --dst-cc, --destination-country country[,country,country,...]
              Match packet going to (one of) the specified country(ies)

       NOTE:  The country is inputed by its ISO3166 code.

       The  only extra files you need is a binary db (geoipdb.bin) & its index
       file (geoipdb.idx).  Both files are generated from a countries  &  sub‐
       nets   database   with   the   csv2bin  tool,  available  at  www.cook‐
       inglinux.org/geoip/. Both files MUST also be moved  in  /var/geoip/  as
       the  shared  library  is  statically  looking  for  that pathname (ex.:
       /var/geoip/geoipdb.bin).