Adding custom IP lists to block or allow

[oraculix]

Hi,
recently, I couldn't connect to my machine while I was using a Starlink connection.
I use geoip-shell with RIPE to allow incoming traffic from my country.
The strange thing is: When querying RIPE with whois, the assigned IP (v4) is correctly geo-located, but gets denied on my machine anyway.

Starlink is a special case anyway, because the exit nodes are "floating" or, in other words, IPv4 addresses might change many times and might come from seemingly other countries at times.

As I don't want to allow-list the whole EU, I thought about importing Starlink's GeoIP list and using IP ranges from there.

Do you see the possibility to import such custom lists and merge them with the other data?

[friendly-bits]

When querying RIPE with whois, the assigned IP (v4) is correctly geo-located, but gets denied on my machine anyway

It is possible that there is a discrepancy between the whois data and the data served via RIPE API. To check specifically in the ip list fetched by geoip-shell from RIPE, use the included check-ip-in-source script this way:

sh check-ip-in-source.sh -i <ip> -c <country_code>

(requires the grepcidr utility)

Generally, if you need more accurate geoip data, consider using the MaxMind source.

Do you see the possibility to import such custom lists and merge them with the other data?

Sure, I'll look into implementing this feature.

[friendly-bits]

Hi @oraculix, local IP lists are now supported in geoip-shell v0.6.9. Please let me know whether the implementation is useful to you.

[oraculix]

Great news, thank you!
I extracted a CSV list of IP ranges into a newline-separated list which I could import with configure -A.
Tomorrow, I'll have the chance to try it out from the affected client and will update you, then.

Cheers,
Uwe

[friendly-bits]

Perfect. You would need to convert the CSV file into file which only contains IP addresses of one family. You can use this command to achieve that for ipv4:

cut -d, -f1 "<path_to_csv_file>" | grep '\.' > "<path_to_new_file>"

If there are ipv6 addresses in that list as well, you can use this command:

cut -d, -f1 "<path_to_csv_file>" | grep ':' > "<path_to_new_file>"

To import both ipv4 and ipv6 addresses, generate separate files for each family and import them sequentially.

If you want to only import IP addresses for a specific country then you can filter the ip addresses in the source CSV file (example for US):

my_country_code=US
grep ",${my_country_code},${my_country_code}-" "<path_to_csv_file>" | cut -d, -f1 | grep '\.' > "<path_to_new_file>"

Optionally, you can further process the resulting list in order to reduce the number of IP addresses with help of my other project shell-ip-tools:

my_country_code="<your_country_code>"
if curl -LO "https://raw.githubusercontent.com/friendly-bits/shell-ip-tools/main/shell-ip-tools.sh" && . ./shell-ip-tools.sh; then \
	curl -L "https://geoip.starlinkisp.net/feed.csv" | grep ",${my_country_code},${my_country_code}-" | cut -d, -f1 | grep '\.' | sed 's~/.*~/24~' | aggregate_subnets ipv4 | sort
fi

This further processing is not really critical but generally the less IP addresses in the ipset, the less work you firewall has to do when processing inbound traffic. I explained what the above commands do in another discussion. That discussion took place before I implemented the local IP lists functionality, which is why the commands there produce a whitespace-separated list which is suitable to use with the geoip-shell configure -t "<trusted_addresses>" command.

[oraculix]

Thanks for all the details. I guess this will go into the documentation as well?
Tried the connections to my machine with the custom IP list from a Starlink site, it works! \o/

This time I built the (very small) IP list manually, but in the future your suggestions using cut and grep to filter to the desired countries will surely come in handy.

Thanks again and cheers,
Uwe