Blocking foreign subnets

Apr 12, 2005 2 Replies

Rate this thread:

John 21 years ago

Does anyone know of a way to easily block foreign subnets? i.e. I only want our firewall to answer to US based subnets. Our logs show that most attacks are coming from foreign sources. Ideally, I'd like to have them broken down by country, and I've found databases online for sale. Are there any reliable free subnet/country databases available? And, what are your thoughts on something like this?

On that note, does anyone know of a firewall with this feature built in? Or would the blocking firewall still be susceptible to attacks?

John

Vote

Ken 21 years ago

You can get that information free from ARIN via FTP. ARIN is the American Registry for Internet Numbers. They handle the allocation of blocks of IP addresses to ISPs for the U.S., Canada, and some other areas, but they also make available the information from the other Regional Internet Registries.

FTP to ftp.arin.net Go to /pub/stats Go into the apnic, arin, lacnic, and ripencc directories and pick up the most recent "delegated" file from each, selecting the large file from each set (hundreds of thousands of bytes). Be sure to transfer in ASCII mode as they are text files. They don't have an extension to clue your FTP client to automatically select ASCII mode if it has that capability.

Vote

Walter Roberson 21 years ago

In article , John wrote: :Does anyone know of a way to easily block foreign subnets? i.e. I only :want our firewall to answer to US based subnets.

Some of the messages in the thread starting from the following may be of interest to you:

formatting link

Vote

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required