GeoIP Based Country Blocking for Apache

The Chinese won’t leave me alone and it’s cluttering Fail2Ban, so I’m resorting to just embargo blocking China. This isn’t likely to work in the long run, so I’ll have to back out the changes.

Here are the sources for the following information:

Installation

I installed geoip modules for apache via the urpmi package management. As of now, I haven’t configured an update for the geoip. I’m not sure it’s really necessary.

I created a /etc/httpd/conf.d/geoip.conf file and tested it:

   [root@shuttle conf.d]# geoiplookup 1.1.1.1
   GeoIP Country Edition: AU, Australia
   GeoIP ASNum Edition: AS15169 Google Inc.

Enable GeoIP

Edit the geoip.conf file. Just tack this onto the end:

   <IfModule mod_geoip.c>
   GeoIPEnable On
   GeoIPDBFile /usr/share/GeoIP/GeoIP.dat
   GeoIPScanProxyHeaders On
   </IfModule>
   

Enable Country Blocking

In /etc/httpd/conf/conf.d/geoip.conf:

     <IfModule mod_geoip.c>
     GeoIPEnable On
     GeoIPDBFile /usr/share/GeoIP/GeoIP.dat

     <Directory />
     # SetEnvIf GEOIP_COUNTRY_CODE AN BlockCountry
     SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
     # add any number of countries here based on your requirement
     # you can refer to the country codes in GeoIP website.

     Deny from env=BlockCountry
     </Directory>

     </IfModule>

Block China

The country code for China, according to the ISO 3166 Country Codes is “CN”. So the file actually looks like this:

<IfModule mod_geoip.c>
GeoIPEnable On
GeoIPDBFile /usr/share/GeoIP/GeoIP.dat
GeoIPScanProxyHeaders On
</IfModule>

<IfModule mod_geoip.c>
GeoIPEnable On
GeoIPDBFile /usr/share/GeoIP/GeoIP.dat


<Directory />
SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
# SetEnvIf GEOIP_COUNTRY_CODE BL BlockCountry
# add any number of countries here based on your requirement
# you can refer to the country codes in GeoIP website.

Deny from env=BlockCountry
</Directory>

</IfModule>

Again, this is probably going to be backed out. I’m not sure exactly which door the Chinese are knocking on. It’s just listed as “ssh” and fail2ban is not specific about which port is being bothered. I’m assuming it’s 22, but that’s been disabled forever, there’s nothing on the internet-facing port 22 on my router.

More Information

This information about various configuration options may prove handy at some point.

More later.