Port forwarding and geoblock

[peter]

I am using port forwarding to my local network (NAS,satbox) and I would like to extend security with geoblocking.
Is it possible "forwarded port" to allow only for specific country via geo-block in ip-tables? How?

 

[florid]

You can refer https://github.com/RMerl/asuswrt-merlin/wiki/Iptables-tips for restricted port forwarding to certain IP range.
Not familiar with geo-block. But if you have the country wide IP data, it is not that difficult.

 

[Martineau]

Is it possible "forwarded port" to allow only for specific country via geo-block in ip-tables? How?

Assuming you have created an appropriate IPSET containing the banned IP addresses (BlockedCountries) you wish to block
e.g.

ipset list BlockedCountries

Name: BlockedCountries
Type: hash:net
Revision: 0
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 8500
References: 10109
Members:

./IPSET_List.sh BlockedCountries

IPSET BlockedCountries==>
     1.0.1.0/24      1.0.2.0/23      1.0.8.0/21     1.0.32.0/19      1.1.0.0/24      1.1.2.0/23      1.1.4.0/22      1.1.8.0/24      1.1.9.0/24     1.1.10.0/23     1.1.12.0/22     1.1.16.0/2    1.1.32.0/19      1.2.0.0/23      1.2.2.0/24      1.2.4.0/24      1.2.5.0/24      1.2.6.0/23      1.2.8.0/24      1.2.9.0/24     1.2.10.0/23     1.2.12.0/22     1.2.16.0/20     1.2.32.0/1    1.2.64.0/18      1.3.0.0/16      1.4.1.0/24      1.4.2.0/23      1.4.4.0/24      1.4.5.0/24      1.4.6.0/23      1.4.8.0/21     1.4.16.0/20     1.4.32.0/19     1.4.64.0/18      1.6.0.0/1     1.8.0.0/16     1.10.0.0/21     1.10.8.0/23    1.10.11.0/24    1.10.12.0/22    1.10.16.0/20    1.10.32.0/19    1.10.64.0/18     1.12.0.0/14     1.22.0.0/15     1.24.0.0/13     1.38.0.0/1    1.45.0.0/16     1.48.0.0/15     1.50.0.0/16     1.51.0.0/16     1.56.0.0/13     1.68.0.0/14     1.80.0.0/13     1.88.0.0/14     1.92.0.0/15     1.94.0.0/15    1.116.0.0/14    1.180.0.0/1   1.184.0.0/15    1.186.0.0/16    1.187.0.0/16    1.188.0.0/14    1.192.0.0/13    1.202.0.0/15    1.204.0.0/14     14.0.0.0/21    14.0.12.0/22     14.1.0.0/22    14.1.24.0/22    14.1.96.0/2

<snip> etc.

see https://www.snbforums.com/threads/h...ng-ipset-firewall-addition.16798/#post-115872

Then you should be able to code a single rule
e.g.

iptables -I VSERVER -t nat -m set ! --match-set BlockedCountries src -p tcp -m tcp --dport 12345 -j DNAT --to 172.16.0.12:34567


iptables -nvL VSERVER --line -t nat

Chain VSERVER (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ! match-set BlockedCountries src tcp dpt:12345 to:172.16.0.12:34567

or you could obviously create an IPSET containing only the allowed IP addresses (AllowedCountries) and remove the "not match" '!' logic from the VSERVER rule whilst referencing this allowed IPSET etc.

P.S. Personally, I'm not sure if this is worth the effort since SmartDNS/VPNs etc. can mask the country of origin?