This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Country Blocking: Netherlands problem

Hi,

On UTM 9.209, I have Country Blocking enabled for numerous countries.

One of our partners is unable to connect to our site, and I see from the logs that Country Blocking is the reason:

2015:02:08-02:29:29 fw ulogd[5601]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth0" outitf="eth1" srcmac="***x" dstmac="***x" srcip="128.199.51.x" dstip="69.x.x.x" proto="6" length="60" tos="0x00" prec="0x00" ttl="55" srcport="42412" dstport="80" tcpflags="SYN"

Maxmind shows the source IP is in Amsterdam, Netherland: https://www.maxmind.com/en/geoip-demo. Digital Ocean is listed as the ISP.

I was not blocking Netherlands, but I was blocking Netherlands Antilles (listed under North America as it's in the Caribbean).

fwiw, WhatIsMyIp.co 128.199.51.0 - 128.199.51.255 - Digital Ocean, Inc USA
shows it is registered through RIPE to Digital Ocean in New York, USA.
(I am not blocking USA)

So, I'm not sure if it's being blocked because:
a. Netherlands Antilles was selected
b. the data doesn't match what's currently on Maxmind?

Any ideas how to debug this?

I'm going to ask the partner to leave a ping going so I can try unblocking other countries if opening Netherlands Antilles doesn't help.

Thanks!
Barry

This thread was automatically locked due to age.

0 Scott_Klassen over 10 years ago

@Barry: From the shell, use the command geoiplookup to query the IP and see what is returned.

The query on the Maxmind website uses their full commercial database, updated several times per day. UTM uses Maxmind free, which is updated once per month. There's a good chance that the IP was incorrectly classified, which has since been corrected in the Maxmind Commercial database, but we'll have to wait some time for the next update of the free version on our UTMs.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Thanks Scott...

geoiplookup reports 'NL, Netherlands'.

As I didn't have Netherlands blocked, I'm still confused, but I have unblocked Netherlands Antilles and asked the partner to re-test and leave a ping running.

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 10 years ago

Sorry, I missed that they weren't blocking netherlands. Let us know how the retest goes. If you have shell access to their box, you could try curl to test yourself.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Hi,

The partner tried Curl over the weekend; that and/or connections from their other tools do appear in the packetfilter logs.

I'm now asking them to leave Curl running in a loop.

Thanks,
Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Unblocking Asia seems to do the trick; I'm trying to narrow it down to a specific country.

I will open a support case as this is obviously a bug.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Blocking Singapore in Country Blocking on 9.209 is blocking 128.199.51.0/24, which is listed as NL/Netherlands by 'geoiplookup' and online.

I wonder if any other countries are mixed up.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

fwiw, 'cc get geoip' shows SG and NL are getting set when choosing Singapore and Netherlands, respectively.
i.e. the correct country values are getting set in the config db.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 10 years ago

Sophos has reproduced the issue (on my UTM, not sure about on theirs) and is escalating the case.
Case ID: 4945199

I'm now on 9.211, fwiw.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 10 years ago

Cool. Hopefully they'll get it resolved for you quickly. *fingers crossed*
Cancel
Vote Up 0 Vote Down

Cancel
0 RFCat_vk_01 over 10 years ago in reply to Scott_Klassen

Hi,
try China, I have China blocked and three address ranges keep coming.

222.168 117.21 and 61.160

Ian M
Cancel
Vote Up 0 Vote Down

Cancel