This article is a step-by-step tutorial that shows you how to configure your iptable firewall with firewalld to allow only requests originating from a country
firewalld is based on iptable and therefore supports the same concept such as:
To filter by country, you need to:
This article gives you a detailed step-by-step on how to do it.
GeoDNS is also another way to block by country.
Create your file
Each set of ip has a storage format called the type that defines :
- the type of input file used to define the set.
- the storage type and therefore the lookup time
You can't change this format once the ip set is created.
To store the IP of a country, we will use the hash:net format because it store the information by range ( not by ip as the hash:ip format is doing)
The file format for a hash:net type is:
ip ip[/cidr] fromaddr-toaddr
You create them from a IP geolocalization database.
For example from the GeoIp database, in Postgress, we have just run this command to get all Netherlands IP subnet.
SELECT inet_merge( '0.0.0.0'::inet + ip_from, '0.0.0.0'::inet + ip_to ) from ip where ctry = 'NL'
The output was used to create this file called ipset_nl.txt in this step by step.
184.108.40.206/22 220.127.116.11/22 18.104.22.168/22 22.214.171.124/22 ...
Create a set of ip
The below command create a ipset name of the type hash:ip
firewall-cmd \ --new-ipset=nl \ --type=hash:net \ --permanent \ --option=family=inet
- the option can be found in ipset documentation section of the type (in our case hash:ip)
- family is the protocol family of the IP addresses to be stored in the set (default: inet = ipv4)
- hashsize is the initial hash size for the set (default to 1024)
- maxelem is the maximal number of element (default to 65536)
The command should return:
Load the file into the ipset
To load the file created from the geo database, you would performed this command.
firewall-cmd \ --ipset=nl \ --permanent \ --add-entries-from-file=/tmp/ipset_nl.txt
Reload to load the ipset in memory and therefore make it visible to the ipset command
systemctl reload firewalld
Check that the ipset is not full
ipset -t list nl
Name: nl Type: hash:net Revision: 6 Header: family inet hashsize 2048 maxelem 65536 Size in memory: 135032 References: 0 Number of entries: 5139
Their is one line by entry (ie 5139) and the memory size is 135032/1024=131kb
While with a hash:ip, you're list would be full because the record is not at the net level but at the ip. It creates therefore all IP for each subnet.
Name: nl Type: hash:ip Revision: 4 Header: family inet hashsize 524288 maxelem 1000000 Size in memory: 22553880 References: 0 Number of entries: 1000000
Test the IP Set
You can test your IP.
- A Canada IP should not be in the set.
ipset test nl 126.96.36.199
188.8.131.52 is NOT in set nl.
- A Netherlands IP should be in the set.
ipset test nl 184.108.40.206
Warning: 220.127.116.11 is in set nl.
Add a rule to drop all packets that does not come from the IPSet
Adding a rule that drops all packet for the ssh Firewalld (port 22) if they are not from Netherlands
firewall-cmd \ --zone=public \ --permanent \ --add-rich-rule='rule family="ipv4" source not ipset="nl" service name="ssh" drop'
Reload and Test
When your restart you are making the rules active. If you are locked out because of any manipulation, check this article that will help you recover your system.
Made the rule permanent.
systemctl stop firewalld systemctl start firewalld # systemctl reload firewalld
- that you can connect
- that you can't if you can use a VPN
- or just check the log for bot
Check the log;
systemctl status firewalld # or tail -20 /var/log/firewalld
Check that the rule is still present
Hash is full
ERROR: COMMAND_FAILED: '/usr/sbin/ipset restore' failed: ipset v7.1: Error in line 45: Hash is full, cannot add more elements
If you use the ipset type hash:ip and that you use a subnet as entry, each subnet is transformed to create an entry for each IP and you can quickly be full.
ipset -t list nl
Name: nl Type: hash:ip Revision: 4 Header: family inet hashsize 32768 maxelem 65536 Size in memory: 1444728 References: 0 Number of entries: 65536
- use the format hash:net if you entries are subnet
- or increase the size of your ipset with the maxlen option