Difference between revisions of "M4 Blocked Countries"
| (One intermediate revision by the same user not shown) | |||
| Line 8: | Line 8: | ||
[[File:M2_Blocked_Countries_Menu.png]]<br> | [[File:M2_Blocked_Countries_Menu.png]]<br> | ||
On the newly opened page, a list of Country names is present along with their [http://www.iso.org/iso/home/standards/country_codes.htm ISO 3166] Codes.<br> | |||
[[File:M2_Blocked_Countries.png]]<br> | [[File:M2_Blocked_Countries.png]]<br> | ||
| Line 18: | Line 18: | ||
The list of the to-be-blocked Countries is stored in the Database which is shared among the Servers. Each Server will use the Database to update its iptables.<br> | The list of the to-be-blocked Countries is stored in the Database which is shared among the Servers. Each Server will use the Database to update its iptables.<br> | ||
The aggregated IP addresses for each Country | The aggregated IP addresses for each Country are downloaded from [http://www.ipdeny.com/ipblocks/ ipdeny.com] and added to the IPSets which are then included in the iptables.<br> | ||
Every month the Servers will renew their IP address Database to have the latest data.<br> | Every month the Servers will renew their IP address Database to have the latest data.<br> | ||
| Line 32: | Line 32: | ||
If the '''Blocked Countries''' functionality is not installed on any of the Servers, the GUI will show a warning (this means that the Kernel does not support the IPset).<br> | If the '''Blocked Countries''' functionality is not installed on any of the Servers, the GUI will show a warning (this means that the Kernel does not support the IPset).<br> | ||
Also, the Servers '''must''' allow the | Also, the Servers '''must''' allow the HTTP connections which are needed for file download. | ||
<br><br> | <br><br> | ||
== See also == | == See also == | ||
* [[Blocked Countries installation problem. Please contact Support in order to solve it]] | * [[Blocked Countries installation problem. Please contact Support in order to solve it]] | ||
Latest revision as of 11:23, 29 November 2022
Description
Blocked Countries is a security abstraction over the iptables. The functionality is used to block entire countries from accessing your Servers.
Usage
Blocked Countries is only available to the System Admin.
Got to SECURITY > Blocked Countries.
On the newly opened page, a list of Country names is present along with their ISO 3166 Codes.
The to-be-blocked Countries can be checked and after clicking the Save button at the bottom of the list they will be blocked.
NOTE: Depending on the number of Countries checked the process might take up to 4-5 minutes of time.
How it works
The list of the to-be-blocked Countries is stored in the Database which is shared among the Servers. Each Server will use the Database to update its iptables.
The aggregated IP addresses for each Country are downloaded from ipdeny.com and added to the IPSets which are then included in the iptables.
Every month the Servers will renew their IP address Database to have the latest data.
NOTE: Each country Blacklist has a default Whitelist for misconfiguration and emergency cases. This list includes the Server IP, Kolmisoft Support access, the Server DNS Servers, the ipdeny.com API, the MOR Servers, and the ACCEPT rule for all the SSH traffic on port 22.
Scope and Limitations
There is a chance that on some Servers the functionality may not be installed because of Kernel's incompatibility to support the IPSet.
For this to work your Kernel version must be greater or equal to 2.6.32 and must support the ip_set and ip_set_hash_netport modules.
If the Blocked Countries functionality is not installed on any of the Servers, the GUI will show a warning (this means that the Kernel does not support the IPset).
Also, the Servers must allow the HTTP connections which are needed for file download.
