Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenBSD 5.2 box what's running a webserver on port 80 and an SSHD server on port 2222.

How can I configure OpenBSD's pf to only allow connections from given countries to port 80 and 2222?

share|improve this question
up vote 5 down vote accepted

Short answer: The Internet Doesn't Work That Way

Longer answer: IP address blocks are not neatly demarcated per country. As far as IPv4 is concerned, the parent organization IANA allocated (past tense -- they're out of blocks) address blocks to the various NICs, which operate in very wide regions as you can see here. They then assign IP blocks to ISPs on a per-case basis depending on what the ISP says they'll need -- and at that level, the ISPs they generally trade with tend to straddle borders.

I'm not familiar with the exact specifics of pf as opposed to linux' iptables but I'm reasonably sure both of them work on an IP/netblock basis. Maybe you could massage a geolocation database to spit out a list of all netblocks it's almost certain are exclusive to one country or another, but I wouldn't bet on it.

On a more cynical note, you might want to ask the Iranian or Chinese governments for advice on how they try to handle it, but I'd hold up neither of them as role models for proper internet usage...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.