Firewalld - Country Filtering

1 - About

How to create a packet filtering by country with firewalld.

firewalld is based on iptable and therefore the same concept such as zone, a service and rule applied also for firewalld.

To filter by country, you need to:

  • create an ipset which is a set of ip.
  • and apply your rule on this ip set.

This article gives your a detailed step by step on how to do it.

GeoDNS is also another way to block by country.

3 - Steps

3.1 - Create your file

Each set of ip has a storage format called the type that defines :

  • the type of input file used to define the set.
  • the storage type and therefore the lookup time

You can't change this format once the ip set is created.

To store the IP of a country, we will use the hash:net format because it store the information by range ( not by ip as the hash:ip format is doing)

The file format for a hash:net type is:


ip
ip[/cidr]
fromaddr-toaddr

You create them from a IP geolocalization database.

For example from the GeoIp database, in Postgress, we have just run this command to get all Netherlands IP subnet.


SELECT 
    inet_merge(
       '0.0.0.0'::inet + ip_from, 
       '0.0.0.0'::inet + ip_to
   ) from ip 
where ctry = 'NL'

The output was used to create this file called ipset_nl.txt in this step by step.


2.56.16.0/22
2.56.32.0/22
2.56.56.0/22
2.56.100.0/22
...

3.2 - Create a set of ip

The below command create a ipset name of the type hash:ip


firewall-cmd \
    --new-ipset=nl \
    --type=hash:net \
    --permanent \
    --option=family=inet  

where:

  • the option can be found in ipset documentation section of the type (in our case hash:ip)
    • family is the protocol family of the IP addresses to be stored in the set (default: inet = ipv4)
    • hashsize is the initial hash size for the set (default to 1024)
    • maxelem is the maximal number of element (default to 65536)

The command should return:


success

3.3 - Load the file into the ipset

To load the file created from the geo database, you would performed this command.


firewall-cmd \
    --ipset=nl \
    --permanent \
    --add-entries-from-file=/tmp/ipset_nl.txt


success

Reload to load the ipset in memory and therefore make it visible to the ipset command


systemctl reload firewalld

Check that the ipset is not full


ipset -t list nl


Name: nl
Type: hash:net
Revision: 6
Header: family inet hashsize 2048 maxelem 65536
Size in memory: 135032
References: 0
Number of entries: 5139

Their is one line by entry (ie 5139) and the memory size is 135032/1024=131kb

While with a hash:ip, you're list would be full because the record is not at the net level but at the ip. It creates therefore all IP for each subnet.

Name: nl
Type: hash:ip
Revision: 4
Header: family inet hashsize 524288 maxelem 1000000
Size in memory: 22553880
References: 0
Number of entries: 1000000

3.4 - Test the IP Set

You can test your IP.

  • A Canada IP should not be in the set.

ipset test nl 167.114.98.233


167.114.98.233 is NOT in set nl.

  • A Netherlands IP should be in the set.

ipset test nl 143.176.205.82


Warning: 143.176.205.82 is in set nl.

3.5 - Add a rule to drop all packets that does not come from the IPSet

Adding a rule that drops all packet for the ssh Firewalld (port 22) if they are not from Netherlands


firewall-cmd \
    --zone=public \
    --permanent \
    --add-rich-rule='rule family="ipv4" source not ipset="nl" service name="ssh" drop'


success

3.6 - Reload and Test

When your restart you are making the rules active. If you are locked out because of any manipulation, check this article that will help you recover your system.

Made the rule permanent.


systemctl stop firewalld
systemctl start firewalld
# systemctl reload firewalld

Test:

  • that you can connect
  • that you can't if you can use a VPN
  • or just check the log for bot

Check the log;


systemctl status firewalld
# or tail -20 /var/log/firewalld

Check that the rule is still present


firewall-cmd --list-rich-rule

4 - Support

4.1 - Hash is full

ERROR: COMMAND_FAILED: '/usr/sbin/ipset restore' failed: ipset v7.1: Error in line 45: Hash is full, cannot add more elements

If you use the ipset type hash:ip and that you use a subnet as entry, each subnet is transformed to create an entry for each IP and you can quickly be full.

Example:


ipset -t list nl


Name: nl
Type: hash:ip
Revision: 4
Header: family inet hashsize 32768 maxelem 65536
Size in memory: 1444728
References: 0
Number of entries: 65536

Solution:

  • use the format hash:net if you entries are subnet
  • or increase the size of your ipset with the maxlen option

Data Science
Data Analysis
Statistics
Data Science
Linear Algebra Mathematics
Trigonometry

Powered by ComboStrap