All posts by neutrinus

Beat Caveng, Developer by A-Enterprise GmbH. Blog Author to the Themes, Python and Open Source. Tutorials to Python Troubleshooting and Shell Scripts.

GeoIP Firewall Configuration on Debian and Ubuntu

More security with GeoIP lockout for Debian and Ubuntu server

In this Turorial, the deployment and application of GeoIP with the kernel firewall of Debian 10 (buster) and Debian 11 (bullseye) or Ubuntu 20.04 LTS is applied. In addition to TLS connections and 2FA authentication, another instance is a firewall that can regulate the data traffic. Based on the public IP address, it is quite easy to determine from which city or from which region the access is currently taking place.

In addition, further considerations should be made whether the accessibility of websites and services from countries far away from local languages is at all appropriate, and relations may not be maintained with distant regions, such as to South Pacific. When tracking the sources of brute force and DDoS attacks, the sources are often found in the Far East and Russia.

A geolocation system is used to determine the location of systems. On the Internet, an IP address can be assigned to a country, a city or an organization in order to then determine the location.

Installation

The installation of the required services and libraries for GeoIP on Debian and Ubuntu is done as root with “su -” or “sudo su -“.

$ apt update && apt upgrade
$ apt -y install curl unzip perl iptables-dev xtables-addons-common libtext-csv-xs-perl libmoosex-types-netaddr-ip-perl pkg-config

The GeoIP database must be downloaded from the MaxMind website, with the following URL: https://www.maxmind.com. MaxMind is a Massachusetts-based digital mapping company that provides location data for IP addresses.

MaxMind requires you to register for the Free Account with a valid email. After logging in, go to My Account and Download Databases.

The GeoIP database must be downloaded from the Maxmind website

Under GeoIP2 and GeoIP Legacy Databases – GeoLite2-Country-CSV Format with Download ZIP download the file.

GeoIP2 and GeoIP Legacy Databases

  If you want to perform the download using Permalink, you need a license key, which you can generate under “My Account – Manage License Keys”, the download did not work here at this time (401 Unauthorized).

The contents of the GeoLite2-Country-CSV_20220125.zip ZIP file

GeoLite2 country CSV_20220125.zip

Create a new directory on the host and switch to it.

$ mkdir -p /usr/share/xt_geoip/
$ cd /usr/share/xt_geoip

Upload the downloaded country-CSV_20220125.zip file to the Debian or Ubuntu server using ftp or scp, xt_geoip to the directory path /usr/share/and and unzip it.

$ unzip GeoLite2-Country-CSV_20220125.zip
$ cd GeoLite2 country CSV_20220125
$ /usr/lib/xtables-addons/xt_geoip_build -D /usr/share/xt_geoip *.csv

The CSV data is converted using the MaxMind CSV database converter to binary for xt_geoip. The output appears similar to the following, here in abbreviated form.

729578 entries total
    0 IPv6 ranges for
   16 IPv4 ranges for
362309 IPv6 ranges for 0 0
365215 IPv4 ranges for 0 0
    0 IPv6 ranges for 1 0
   28 IPv4 ranges for 1 0
    0 IPv6 ranges for AD Andorra
    8 IPv4 ranges for AD Andorra
...

The module xt_geoip load into memory with subsequent testing.

$ modprobe xt_geoip
$ lsmod | grep ^xt_geoip

The output should be similar to this.

xt_geoip 16384 34

The GeoIP integration for iptable is now complete, commands can now be executed with the following syntax.


iptables -m geoip –src-cc country[,country] -dst-cc country[,country]

For example, traffic from Russia and China should be blocked.

$ iptables -A INPUT -m geoip --src-cc RU,CN -j DROP

Example block accesses that do NOT come from Germany.

$ iptables -A INPUT -m geoip ! --src-cc EN -j DROP

It can also block the outgoing traffic, here to India.

$ iptables -A OUTPUT -m geoip -dst-cc IN -j DROP

  Helpful iptables commands.

$ iptables -vnL
$ iptables -L INPUT --line-numbers -vn

The output might look something like the following.

Chain INPUT (policy DROP 259 packets, 13704 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1    68011   14M f2b-apache-auth  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
2     155K   41M f2b-sshd   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
3     272K   12M ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country RU,CN
5       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country BY,CY

This example swipe row 5.

$ iptables -D INPUT 5

Query ISO Country Code of an IP address.

$ apt install geoip-bin

Example query with geoiplookup.

$ geoiplookup 61.219.11.151
GeoIP Country Edition: TW, Taiwan

Example with iptables and GeoIP

An example with ISO codes for countries that are classified as obscure or as known suspicious havens and are explicitly blocked, the ISO codes of the DACH countries should be approved.

$ iptables -P INPUT DROP
$ iptables -A INPUT -m geoip --src-cc AT,CH,DE -j ACCEPT
$ iptables -N DROP_GEOIP
$ iptables -A DROP_GEOIP -m geoip --src-cc ID -j DROP
$ iptables -A DROP_GEOIP -m geoip --src-cc KP -j DROP
$ iptables -A DROP_GEOIP -m geoip --src-cc TJ -j DROP
$ iptables -A DROP_GEOIP -m geoip --src-cc TM -j DROP
$ iptables -A DROP_GEOIP -m geoip --src-cc TR -j DROP
$ iptables -A DROP_GEOIP -m geoip --src-cc UA -j DROP
$ iptables -A DROP_GEOIP -m geoip ! --src-cc AT,CH,DE -j DROP
$ iptables -A INPUT -j DROP_GEOIP

  The (!) argument inverts the passed values, which excludes ISO (AT,CH,DE) from jump to DROP.

Check the iptables INPUT chain with line-numbers, the output as follows for this example.

$ iptables -L INPUT --line-numbers -vn
Chain INPUT (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     273K   12M ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
2     273K   12M ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
3     273K   12M ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
4       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country RU,CN
5       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country BY,CY
6       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country HK,KP
7       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country KG,KZ
8       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country UA,VN
9       0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country MD,GE
10      0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country TW,TM
11    102  5329 DROP_GEOIP all  --  *      *       0.0.0.0/0            0.0.0.0/0
12     90  4827 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip ! --source-country AT,CH,DE

iptables-persistent

Reactivate the iptables chains after a restart, to do this iptables-persistent is installed.

$ apt install iptables-persistent

Confirm with yes to back up the iptables during installation.

Install iptables-persistent

The iptables chains can be backed up with iptables-save to restore them at a later time.

$ iptables-save > /etc/iptables/rules.v4
$ ip6tables-save > /etc/iptables/rules.v6

Recovery with iptables-restore.

$ iptables-restore < /etc/iptables/rules.v4
$ ip6tables-restore < /etc/iptables/rules.v6

Linux Mint MATE desktop and Cinnamon desktop

MATE-Desktop or Cinnamon-Desktop

MATE is one of the most popular Linux desktop environments, alongside the Cinnamon desktop environment. The MATE desktop is based on the Gnome Shell. Linux Mint is one of the many distributions that include the MATE desktop and Cinnamon desktop.

MATE Desktop Environment

The history of MATE is quite exciting. It’s actually the sequel to GNOME 2. GNOME is the most widely used desktop environment. But the big change came with the release of v3. It was a completely different design than that of the classic GNOME 2. It caused a huge uproar in the community, which loved and nurtured the classic look.

This is where MATE began its journey as a fork of GNOME 2 with numerous improvements and new features. Still, it remains true to the original GNOME 2.

Linux Mint is one of the most popular Linux distributions, many choose the Linux Mint Cinnamon Edition to install as operating system. Linux Mint is also involved in the development of MATE, a classic desktop environment that is the sequel to GNOME 2, the default desktop of Linux Mint between 2006 and 2011. Although some features are missing and its development is slower than Cinnamon’s, MATE runs faster, consumes fewer resources and is more stable than Cinnamon.

Install MATE-Desktop

If you want to switch to the MATE desktop environment at a later time after installing Linux Mint Cinnamon Edition, there is the possibility to add a second graphical desktop environment as an alternative to the already installed desktop environment, with the following command from Gnome Terminal Shell.

$ sudo apt install mint-meta-mate

Install Cinnamon-Desktop

If it is the other way around, if you have the Linux Mint MATE Edition installed on the system, the Cinnamon desktop environment can be added.

$ sudo apt install mint-meta-cinnamon

Now you have to log out, the login screen now shows an icon next to the user name, via the icon “Select Desktop environment” the graphical desktop environment is selected.