0

I have a requirement to drop network traffic from countries which the United States is under an embargo with. Dropping traffic from certain CIDR blocks is trivial to do with AWS VPC, but I am curious about how to test whether or not my implementation is working correctly.

The options I have determined are:

  1. Block the CIDR range of my own US-based traffic to determine if it drops
  2. Locate a VPN service which terminates in one of the embargoed countries

In 2016 the embargoed countries are:

  • Iran
  • North Korea
  • Sudan
  • Syria
  • Myanmar

I am concerned about the legal ramifications of option 2, and the validity of the results generated by option 1.

Are there any suggestions on how to proceed?

Improve this question
  • 1
    I am courious how you find CIDR blocks of these countries and keep them up to date? Also, doing option 2 is probably illegal if you have to implement this blocking in the first place. – billc.cn Oct 12 '16 at 14:36
  • Here is one source of blocks: countryipblocks.net – TFerrell Oct 12 '16 at 14:48
1

One simple way of testing your filters is to spoof a TCP SYN packet with one of the IPs black-listed.

Another way is to check the FW that AWS is offering if it has a simulation feature where you enter the desired packet information (Source IP, Source Port, Destination IP, Destination Port) and see what the firewall will do with it through its current configuration.

In regard to the validity of the offered lists that is not something i can comment since i do not know where AWS is obtaining these lists.

Hope this helps

Improve this answer
-1

CIDR has to do with subnetting and the available addresses given a certain subnet mask. For example: There are 32 CIDR schemes. CIDR scheme /28 has a subnet mask of 255.255.255.240 which means that there are 16 IP address per subnet that can be assigned utilizing this scheme. /27 has 32 IP address per subnet, /26 has 64 IP addresses per subnet and so on the lower you go. So blocking CIDRs does not make sense. Utilize the following link to check on IP address blocks from foreign countries that you need to drop:

https://www.iana.org/numbers

http://www.nirsoft.net/countryip/

While you said you want to drop traffic from those countries, I must cover myself by adding that I do not recommend creating a VPN into the US from one of the countries you listed. You may one day want to turn it off and the involved parties will likely have resources that rely on the VPN you created. Don't start a situation you can't get out of in RW. Nor do I recommend searching for one in those countries. I'm not saying anyone in those countries is evil, but the saying goes "When you study evil, you are studied by evil." Tread lightly.

Improve this answer
  • "So blocking CIDRs does not make sense." Nothing you have said before that point would lead anyone to think that it did not make sense. Your links provide easy to provide CIDR notation for: 5.22.192.0 - 5.22.223.255 = 5.22.192.0/19. So, you appear to completely wrong. Did I miss something? – schroeder♦ Jan 1 '18 at 20:14
  • Also, your reasoning for not doing VPNs makes no sense at all. It's for testing, no dependencies will be created (and even if they were, why is it limited to these countries? The OP is not supposed to be able to accept traffic from them anyway). Your last 'advice' is completely without context. Lots of VPN providers offer a range of exit nodes. All one has to do is to look for one that includes the desired countires ... – schroeder♦ Jan 1 '18 at 20:17
  • 1st: Point: You've clarified my point that CIDR blocks are not the solution for the OP. He needed address ranges for his solution, not CIDR ranges. For instance, blocking CIDR /19 with the address range you provided does not mean OP is blocking what he needs to. There may addresses within that CIDR that he should "test" for. Blocking CIDR blocks seemed an inaccurate statement for what OP was asking for. – ArchWeb Jan 1 '18 at 20:51
  • 2nd Point: I agree, last "advice" has no basis in OP or other posts on this thread. However, I stand by the advice in that testing often leads to implementation. – ArchWeb Jan 1 '18 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.