I have an OpenBSD 5.2 box what's running a webserver on port 80 and an SSHD server on port 2222.

How can I configure OpenBSD's pf to only allow connections from given countries to port 80 and 2222?


Short answer: The Internet Doesn't Work That Way

Longer answer: IP address blocks are not neatly demarcated per country. As far as IPv4 is concerned, the parent organization IANA allocated (past tense -- they're out of blocks) address blocks to the various NICs, which operate in very wide regions as you can see here. They then assign IP blocks to ISPs on a per-case basis depending on what the ISP says they'll need -- and at that level, the ISPs they generally trade with tend to straddle borders.

I'm not familiar with the exact specifics of pf as opposed to linux' iptables but I'm reasonably sure both of them work on an IP/netblock basis. Maybe you could massage a geolocation database to spit out a list of all netblocks it's almost certain are exclusive to one country or another, but I wouldn't bet on it.

On a more cynical note, you might want to ask the Iranian or Chinese governments for advice on how they try to handle it, but I'd hold up neither of them as role models for proper internet usage...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.