Y'know, I was looking at some stuff like this, back in January when some assholes broke into my server. I found an old project that used GeoIP to firewall incoming traffic based on the source's geographical location. Imagine the security benefits of blocking out IPs from shithole countries like Brazil and Romania at the protocol level!

Even the very suggestion of implementing such a thing raised hackles all over the sandal-wearing sections of the open source community, and impassioned cries of racism. Naturally, I set it up immediately. Now, if I could just find that kernel module...

Blocking IP addresses by country is not too difficult. There are places that generate CIDR-format netblocks by country, and it wouldn't be difficult to write a firewall script that would parse file(s) containing that data and add discard rules.

There are a couple of tarpit scripts in http://www.impsec.org/~jhardin/antispam/ that I use on my hosted server to trap SMTP abusers and worm traffic. It's gratifying to see the reports of jerks that are wallowing around in the pit.

John,

Good stuff! Looking through your scripts, I can just imagine some of the lame-ass crap that gets stuck in the tar.

Identifiying IP addresses by GEO isn't really the big problem. I did an anti-comment spam feature on my blog using the ip2cc python package, for example. What I haven't been able to figure out is a way to get that integrated into the firewall tables without just going through the list, and I doubt iptables was really designed with that in mind.

In the past 10 years I've only had 2 breakins on any of my servers (knock on wood), and both times they came in through BIND exploits. And both times they came from countries that had no business whatsoever contacting my machine in the first place, those being China (2001) and Brazil (2007). I don't want my machines even accepting *packets* from those places.

And man, am I tired of getting Google-searches like "SEXS BITCH" from Saudi Arabia. But then, when your blog's got a name like mine, you've got to expect that sort of thing :-/