Threat Shield GeoIP not working (invalid git repository)

Support
1

Hi,
I also have some problems regarding geoip service. In a freshly installed machine I can’t enable blacklist IP from GUI because of the following error

blacklist IP
blacklist IP1010×334 17 KB

If I try to follow the guide in Threat shield — NethServer 7 Final, after config setprop geoip status enabled
and signal-event nethserver-blacklist-save geoips
nothing happens and in
/usr/share/nethserver-blacklist/geoips/ there is only 1 file named *.netset.
If I try to manually run /usr/share/nethserver-blacklist/geoip, it ends this way :

/tmp/tmp.E5DwnnRaNi ~
tar: all-zones.tar.gz: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
/usr/bin/cat: *.zone: No such file or directory
~

strange is, I can download zones.tar.gz file from a normal browser but not from command line, is there a workaround to expand and put the file to correct folder so that IP blacklists can be used?

command line from windows :
C:\Program Files (x86)\GnuWin32\bin>wget https://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz --no-check-certificate
SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc
syswgetrc = C:\Program Files (x86)\GnuWin32/etc/wgetrc
–2021-10-21 16:30:37-- https://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz
resolving www.ipdeny.com… 149.28.239.174
conecting to www.ipdeny.com|149.28.239.174|:443… connected.
OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
Unable to establish SSL connection.

2

Hi @gatto,

It looks that we have misunderstanding, the url you have inserted in the field for the blacklist is the one for the GeoIP. I don’t know for other IP blacklists which works with NS, but this one works for sure

GitHub - firehol/blocklist-ipsets: ipsets dynamically updated with firehol's update-ipsets.sh script

For the GeoIP blocking you are not adding any list/url, just activate and use it as described in the documentation.

Hope this helps.

3

uh oh… my bad… I thought that geoip and blacklist ipset were the same… and also I did’nt understand why geoips was configurable only by command line :thinking:
well, thank you for explaining, anyway I’m tryiing to alow access to my server only from europe, how can I get that ?