Question modGeoIP

[MarcusR]

Hi folks,
some of you will know that - since january 2, 2019 legacy databases were discontinued (GeoLite maxmind)
I used geoIP for modsecurity for ex.

SecGeoLookupDb /usr/share/GeoIP/GeoIP.dat
SecRule REMOTE_ADDR "@geoLookup" "chain,id:20,drop,msg:'Block China IP address'"
SecRule GEO:COUNTRY_CODE "@streq CN"

Anyone an idea how to solve / continue this in the future?

regards
marcus

 

[danami]

Modsecurity version 3 supports the new GeoIP2 databases. More info:
Backport libMaxMinddb (new GeoIP) support to 2.9.x · Issue #1727 · SpiderLabs/ModSecurity

Also a helpful user is converting the new GeoIP2 databases into the legacy format if you are still on Modsecurity 2.9:
GeoIP Legacy Databases

 

[Ehud]

Check this Plesk Support answer:

How to block or whitelist specific countries through Plesk?

Applicable to: Plesk for Linux Plesk for Windows Question How to block specific countries in Plesk? Answer Such a feature is not implemented in Plesk yet.Vote for this feature on the UserVoice p...

support.plesk.com

And Plesk forum:

Question - How to block a country

I run a virtual server and register more and more attacks from Asia. Especially from China and via a provider called DigitalOcean. What is the easiest way to block an entire country in Plesk? With htaccess I can only block access to a single website. And the file has to be read every time a...

talk.plesk.com

And blocking ASN:

Block ASN instead of IP/CIDRs on Ubuntu

I am planning to block too many IPs (60k CIDRs) so I am concerned about the performance of my f1.micro (512MB RAM) Ubuntu 18 server. Is it possible to block ASN instead of blocking individual CIDR...

stackoverflow.com