Comments (9)
nlvw
commented on June 18, 2024
2
@rpthms Good to know about the provider flag but there is a serious bug that accompanies this. When nft-geo-filter fails due to the SSL cert error it blocks all outgoing and incoming traffic when using the 'allow' flag/logic.
/bin/python3 /root/.timers/nft-geo-filter --allow --allow-established --exceptions "128.123.0.0/16" US
The resulting broken ruleset:
from nft-geo-filter.
rpthms
commented on June 18, 2024
1
You could change your IP blocks provider to "ipverse.net" for the time being. Download the latest version of the script and run:
nft-geo-filter --provider ipverse.net MC
from nft-geo-filter.
b0rZ84
commented on June 18, 2024
1
You could change your IP blocks provider to "ipverse.net" for the time being. Download the latest version of the script and run:
nft-geo-filter --provider ipverse.net MC
Cool. Thanks for the quick answer.
from nft-geo-filter.
rpthms
commented on June 18, 2024
1
I've made an update to the script on a separate branch. Could you download the script from here (https://raw.githubusercontent.com/rpthms/nft-geo-filter/handle_ssl_exceptions/nft-geo-filter) and check if you're still getting locked out when using the --allow flag?
from nft-geo-filter.
nlvw
commented on June 18, 2024
1
That fixed the lockout issue I described.
from nft-geo-filter.
nlvw
commented on June 18, 2024
Also, after inspecting ipverse.net it looks like the site is not HTTPS enabled. This leaves it open to man-in-the-middle attacks (mainly concerned about packet injection) and other vulnerabilities that HTTP is susceptible too.
from nft-geo-filter.
b0rZ84
commented on June 18, 2024
Hi Guys,Nicholas is right and I totally forget to mention this. I was a bit confused when my colleagues called me 6am in the morning that something odd is happening. The only difference for me was besides there were no incoming traffic at all on the server, the outgoing traffic was OK. It took like 10 minutes until I figured out it's the firewall and deleted the corresponding table from nft.So yeah, it would be great to have a fix for this. :)Regards,Zsolt
-------- Eredeti üzenet --------Feladó: Nicholas Von Wolff ***@***.***> Dátum: 2021. 05. 21. 18:01 (GMT+01:00) Címzett: rpthms/nft-geo-filter ***@***.***> Másolatot kap: b0rZ84 ***@***.***>, Author ***@***.***> Tárgy: Re: [rpthms/nft-geo-filter] SSL Cert expired on ipdeny.com (#19)
@rpthms Good to know about the provider flag but there is a serious bug that accompanies this. When nft-geo-filter fails due to the SSL cert error it blocks all outgoing and incoming traffic (despite any configuration or exceptions given).
/bin/python3 /root/.timers/nft-geo-filter --allow --allow-established --exceptions "128.123.0.0/16" US
The resulting broken ruleset:
—You are receiving this because you authored the thread.Reply to this email directly, view it on GitHub, or unsubscribe.
from nft-geo-filter.
rpthms
commented on June 18, 2024
@rpthms Good to know about the provider flag but there is a serious bug that accompanies this. When nft-geo-filter fails due to the SSL cert error it blocks all outgoing and incoming traffic when using the 'allow' flag/logic.
/bin/python3 /root/.timers/nft-geo-filter --allow --allow-established --exceptions "128.123.0.0/16" USThe resulting broken ruleset:
Yikes, that is definitely an issue. Looks like we also need to restore the old sets when we get the urllib.error.URLError exception. I'll submit a patch shortly. Thanks for letting me know @nlvw
from nft-geo-filter.
rpthms
commented on June 18, 2024
Thanks for confirming @nlvw . I've merged the change.
from nft-geo-filter.
Related Issues (20)
- multiple allow HOT 1
- Fallback provider (enhancement) HOT 7
- Add a dry-run option that outputs the new rules to stdout but doesn't modify anything HOT 2
- Netdev set (enhancement) HOT 3
- block by ASN name (ISP) or ASN number HOT 1
- Unexpected keyword argument 'capture_output' in subprocess.run() HOT 3
- ipverse.net UA (Ukraine) bug HOT 10
- Persist IP source data across runs
- Table cleared and not restored while network connection is lost
- not all ip ranges included HOT 11
- ipverse new link structure
- Script Error on Fedora 37 with SELinux
- Adding country TR or RO throws error
- systemd timer
- Allow mode exceptions blocks traffic from private subnets HOT 6
- Allow outgoing traffic to blocked IP ranges HOT 13
- individual IPs HOT 5
- Allow two countries with third country's some IPs HOT 2
- Stop auto flush previous rules when we are adding new rules HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nft-geo-filter.