This is an example on how to use GeoIP lookups in combination with HAProxy.

Data linking requests to its origin country and ASN/ISP can be very useful when dealing with application-level attacks.

This allows you also to handle requests from specific countries and ASNs (p.e. datacenters/hosting providers) differently than others.

NOTE: This functionality is covered by the HAProxy Enterprise Maxmind-Module! Only use this implementation if you are limited to the community edition.

You can implement this in two ways:

• Use a custom backend-service to do this lookups

  Go-based

  Python3-based

• UNTESTED: Use the resty-maxminddb LUA library to query the MMDB databases directly from LUA

1. Request hits HAProxy

2. HAProxy calls LUA script to delegate GeoIP-database lookup

3. LUA calls a minimal web-service on localhost that queries the GeoIP-database(s)

   You can either use a Go-based or Python3-based HTTP-Server as backend

1. Request hits HAProxy

2. HAProxy calls LUA script for querying the GeoIP-database(s)

Change the /tmp/ paths inside the haproxy_example.cfg

You will have to decide if you want to use HAProxy Maps to cache Lookup results.

This can speed-up the lookup for IPs that have already connected to your server.

It will also use more memory.

See also: haproxy_example.cfg - test_country_cachemap

The speed-improvements as seen by running the test-script are: first: 0.03, second: 0.00

By utilizing HAProxy's ipmask (src,ipmask(24,48)) feature we are able to reduce the needed entries inside the map to the minimal subnets that are announced on public BGP.

You will have to download some MMDB GeoIP databases.

Per example from ipinfo.io or maxmind!

Download the binary for you system from the releases.

Read the documentation on how to use it.

You need to use the lua/geoip_lookup_w_go_backend.lua script.

It is recommended to start Go-Backend with -plain command line argument to get the variable in plain text format.

To query the MMDB databases, you will have to install the maxminddb python-module:

python3 -m pip install maxminddb

You will have to update the paths to your database-files in the backend/geoip_lookup_backend.py file!

You need to use the lua/geoip_lookup_w_backend.lua script.

WARNING: UNTESTED

To query the MMDB databases, you will have to install the resty-maxminddb LUA library and its dependencies.

You need to use the lua/geoip_lookup_w_lib.lua script.

# start the web-service
./geoip-lookup &
# initialize the haproxy map(s)
touch /tmp/haproxy_geoip_country.map
# start haproxy
haproxy -W -f haproxy_example.cfg

# start the web-service
python3 backend/geoip_lookup.py &
# initialize the haproxy map(s)
touch /tmp/haproxy_geoip_country.map
# start haproxy
haproxy -W -f haproxy_example.cfg

# initialize the haproxy map(s)
touch /tmp/haproxy_geoip_country.map
# start haproxy
haproxy -W -f haproxy_example.cfg

You will have to copy some GeoIP databases to /tmp:

• '/tmp/maxmind_country.mmdb'
• '/tmp/maxmind_asn.mmdb'
• '/tmp/ipinfo_country.mmdb'
• '/tmp/ipinfo_asn.mmdb'

At least IPInfo OR MaxMind databases need to exist!

cd test
bash test.sh
>
> CLEANUP
>
> WARN: UNABLE TO TEST MaxMind databases as they are missing!
>
> STARTING HAPROXY
>
> TESTING with PYTHON-BACKEND
> LINKING IPInfo databases
> 127.0.0.1 - - [22/Nov/2023 21:21:00] "GET /?lookup=country&ip=1.1.1.1 HTTP/1.1" 200 -
> 127.0.0.1 - - [22/Nov/2023 21:21:00] "GET /?lookup=continent&ip=1.1.1.1 HTTP/1.1" 200 -
> 127.0.0.1 - - [22/Nov/2023 21:21:00] "GET /?lookup=asn&ip=1.1.1.1 HTTP/1.1" 200 -
> 127.0.0.1 - - [22/Nov/2023 21:21:00] "GET /?lookup=asname&ip=1.1.1.1 HTTP/1.1" 200 -
> REQUEST TIMES: 0.01 => 0.00 (cached)
>
> STOPPING HAPROXY
>
> FINISHED - exiting

Feel free to contribute more test-cases!