1

I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the internal network and my home public IP address. Yes, it is not an extremely strong defense, it's just another layer in front of strong mechanisms and most importantly - it helps declutter the logs.

That got me thinking - the server is a mail server that allows users to read their emails over POP3/IMAP and send them using SMTP Submission among other things. These two ports are regularly subjected to automated brute-force attempts. However, since they need to be used by the users from multiple places, I cannot simply whitelist IPs that can access them like I did with the SSH.

I started thinking about alternatives and one came to mind - what if I could restrict these ports to IPs coming from our own country? That would be reasonably permissive and would allow the users to access their emails during business trips/from mobile networks - while still dropping a lot of the scripted brute force attacks.

I'm not asking how I can achieve set this up, but how reliable would such setup be in regard to usability. In other words, I'm afraid of false positives - i.e. legitimate users getting denied access. Are country IP blocks standardised and something I can rely on, or is it common ISPs can distribute IPs locally from other blocks? What about mobile internet providers?

2
  • 1
    Single data point: The UK's National Lottery can only legally be played while you are located in the UK. When accessing their website "out and about" on my mobile, every now and then (perhaps 1 in 5... 1 in 10?) times, it throws up a "Confirm you're in the UK" message. I don't know how they make this determination, but as I won't have given the website "location" permission, I suspect it's based on IP. They're interactive, so can ask for confirmation: for POP3/IMAP/SMTP, you wouldn't be able to ask and so would have to reject such occurrences.
    – TripeHound
    May 18, 2022 at 14:42
  • @TripeHound Thank you for the insight! I sadly don't use any service that would do this to be able to at least observe something similar... and enabling it on the server and then testing it is a little out of the question... May 18, 2022 at 15:17

3 Answers 3

1

Blocks allocated by an certain RIR (Regional Internet Registry), e.g. ARIN, while being allocated to a North American entity can end up being used in another country, it can e.g. happen for an European branch office of an American company.

You can know which prefixes belong to which RIR, i.e. AFRINIC (Africa), APNIC (Asia and Oceania), ARIN (North America minus Mexico), LACNIC (Latin America) and RIPE NCC (Europe, Middle East, Central Asia). Querying whois you can learn which countries the entities that were allocated the addresses belong to but that won't guarantee that the addresses are actually used in the country or even region they are supposed to. So it's not a reliable indicator.

2

I don't know if you can determine if an IP address is used in a given country simply by looking at its prefix.

However, ISPs generally sell the geolocation of their IP addresses and there are databases that map IPs to locations in the world.

If you can get access to the data on one such database or use a service that provides access to some data, you could locally map the IP to its approximate location and see if it belongs to your country.

1

To expand on what others have already mentioned, there are IP location databases for sale and some with API access that can be used for this kind of thing (e.g. ipinfo.io). Cloudflare also provide country detection for free via their web proxy, although you might not be able to use theirs for IMAP/POP3.

From my experience these location databases have reasonably good accuracy for country level (perhaps 80-97% accurate), but relatively poor accuracy for state/city (less than 80%). It's also quite easy for someone to spoof their country by using a VPN. The VPN I use allows me to select from dozens of countries. So this security layer might block 80-90% of unwanted attacks, especially from random bots who will quickly move on, but it won't stop a determined attacker.

Plus, with the poor accuracy you might find the occasional false positive which could frustrate your users, so use with care.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .