5

I've been given a task of creating several filters to block outside traffic by geolocation. In the list of the places that need to be blocked there are several countries (e.g. China and India) and 5 states (Texas, Louisiana, Arkansas, Oklahoma and New Mexico).

Finding IP prefixes by country wasn't a problem (here, for example), but I couldn't locate a similar list by state. This was the closest I could find, but it's not exactly feasible to go through thousands of links and collect this information manually.

Is there such a list anywhere on the Internet or should I start polishing my scripting abilities?

0
8

You're looking for a "Geo Location" database. (One example I've used is Max Mind's products.)

The devil is in the implementation details. The db products are meant to be used programmatically. For example, given a list of IP addresses, we want to know the state, or lat/longitude, country, etc. You could certainly write something (e.g. some Perl code. But the products come with sample libraries for many laguages) that would spit out all the IP addresses, networks, whatever for a given state or zip code. You would have to look through the db products to see which one(s) are organized in a way you can use. Then you have to do something with that list.

Alternatively, you could do something dynamic. Hook into your web server, or server firewall, etc so that packets are looked up on the fly against the Geo Location database (the dbs are local data files you update periodically [eg monthly]) then make a decision, or insert a firewall rule.

None of that is easy, but it's definitely do-able.

2
  • Thank you, I'll look into that. The catch is it has to be ready by tomorrow, and right now I don't see how it happens. May 17 '13 at 19:10
  • also note Justin's answer where he mentions the excellent point that "block by IP" has nothing to do with "block China". :^) May 17 '13 at 19:12
6

The short answer is that doing this correctly is practically impossible.

The long answer is that you will most likely need to talk to a GeoIP company (such as MaxMind). The good ones have nice APIs you can work with that will allow you to query by various regional levels.

The biggest problem with GeoIP is accuracy. A lot of these GeoIP databases have blatantly incorrect information in them. It is rather difficult to exactly pinpoint where a specific prefix is being used without inside knowledge of the network. There's no sure way to know if, for example, a certain prefix was delegated to a customer, and that customer is hauling it back across three states to a branch office.

In the end, its generally a simple task to query a big GeoIP database and build firewall rules and whatnot from that. Its just that you can never be sure of accuracy.

3
  • 100% accuracy is not the goal. Certain percentage of false positives (or negatives) is acceptable. May 17 '13 at 19:16
  • 1
    My point is that its not even close to 100% accuracy. I'd say 75% is even giving it too much credit. I didn't mean to come across as "never do this". This is a perfectly valid thing to do. Its just something to keep in mind as you implement your solution. (Also all the angry emails you'll get about all the false positives ;-) May 17 '13 at 19:17
  • 1
    I understand that. And hopefully so does my client :) May 17 '13 at 19:30
0

If it's difficult to get an accurate mapping between location and IP address, wouldn't an alternative solution perhaps be to rely on client location information from GPS hardware in mobile phones via APIs?

For example, Twitter's API seems to allow for this possibility.

I realize that this would probably require quite a bit more time to implement than you seem to have ("The catch is it has to be ready by tomorrow..."), but since there seems to be general agreement here that a geolocation database will be highly error-prone, I thought that an alternative location source might be more accurate (though I realize also absent from many client requests and perhaps even spoof-able).

Anyway, just my $0.02.

0

Unless you want to get into the GEO-IP mapping business, leave this for the professionals. It will never be 100% and accuracy is probably closer to 70-80% at best. Proxies in front of the clients may mask their actual locations since the proxy IPs would be different. If you're app is HTTP, some Content Delivery Networks (CDNs) if you use one have the ability to embed Geo information in the HTTP request header for your web app to make a block decision on. Again, some CDNs proxy the entire site so the IP connecting to you is never the same as the real client.

See http://en.wikipedia.org/wiki/Geolocation_software.

Not the answer you're looking for? Browse other questions tagged or ask your own question.