Difference between revisions of "Blocked Countries"

From Kolmisoft Wiki
Jump to navigationJump to search
Line 35: Line 35:


Also, the Servers '''must''' allow the http connections which are needed for file download.
Also, the Servers '''must''' allow the http connections which are needed for file download.
ipdeny.com lists are not 100% accurate. If you are having interconnection problems with new IP addresses while the Country block is in use, make sure that those IPs are not within blocked countries ipdeny.com subnets list.


<br><br>
<br><br>

Revision as of 12:35, 19 November 2020

Description

Blocked Countries is a security abstraction over the iptables. The functionality is used to block entire countries from accessing your Servers.



Usage

Blocked Countries is only available to the System Admin.

In the System Admin Menu go to the ADDONS section and expand the Monitorings sub-menu. Click on the Blocked Counties icon (NOTE: This functionality can be used without having a Monitorings Addon enabled, as it is considered to be a general security feature).

MOR Blocked Countries Menu.png

In the newly opened page, a list of Country names is present along with their ISO 3166 Codes.

MOR Blocked Countries.png

The to-be-blocked Countries can be checked and after clicking the Save button at the bottom of the list they will be blocked.
NOTE: Depending on the number of Countries checked the process might take up to 4-5 minutes of time.



How it works

The list of the to-be-blocked Countries is stored in the Database which is shared among the Servers. Each Server will use the Database to update its iptables.

The aggregated IP addresses for each Country is downloaded from ipdeny.com and added to the IPSets which are then included into the iptables.

Every month the Servers will renew their IP address Database to have the latest data.

NOTE: Each country Blacklist has a default Whitelist for misconfiguration and emergency cases. This list includes the Server IP, Kolmisoft Support access, the Server DNS Servers, the ipdeny.com API, the MOR Servers, and the ACCEPT rule for all the SSH traffic on port 22.



Scope and Limitations

There is a chance that on some Servers the functionality may not be installed because of Kernel's incompatibility to support the IPSet.

For this to work your Kernel version must be greater or equal to 2.6.32 and must support the ip_set and ip_set_hash_netport modules.

If the Blocked Countries functionality is not installed on any of the Servers, the GUI will show a warning (this means that the Kernel does not support the IPset).

Also, the Servers must allow the http connections which are needed for file download.

ipdeny.com lists are not 100% accurate. If you are having interconnection problems with new IP addresses while the Country block is in use, make sure that those IPs are not within blocked countries ipdeny.com subnets list.



See also