I have an OpenBSD 5.2 box what's running a webserver on port 80 and an SSHD server on port 2222.
How can I configure OpenBSD's pf to only allow connections from given countries to port 80 and 2222?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Short answer: The Internet Doesn't Work That Way
Longer answer: IP address blocks are not neatly demarcated per country. As far as IPv4 is concerned, the parent organization IANA allocated (past tense -- they're out of blocks) address blocks to the various NICs, which operate in very wide regions as you can see here. They then assign IP blocks to ISPs on a per-case basis depending on what the ISP says they'll need -- and at that level, the ISPs they generally trade with tend to straddle borders.
I'm not familiar with the exact specifics of
pf as opposed to linux'
iptables but I'm reasonably sure both of them work on an IP/netblock basis. Maybe you could massage a geolocation database to spit out a list of all netblocks it's almost certain are exclusive to one country or another, but I wouldn't bet on it.
On a more cynical note, you might want to ask the Iranian or Chinese governments for advice on how they try to handle it, but I'd hold up neither of them as role models for proper internet usage...