[Day 7] 5. LAB 3 GeoIP Traffic Filtering and Logging

Objective:

To block traffic from China and log the packets received, ensuring proper traffic filtering and logging using

iptables

xtables

Steps:

1. Install Required Dependencies:

   bashCopy
   sudo apt-get install -y automake ca-certificates gcc libc6-dev libnet-cidr-lite-perl libtext-csv-xs-perl libxtables-dev linux-headers-$(uname -r) make pkg-config unzip wget xz-utils
   sudo which iptables
   sudo apt-get install iptables -y
   

2. Source Code Extraction:

   • Sir will provide the source code.

   • Extract it using the following command:

     bashCopy
     tar -xf <file_name>
     

   • Note: This command is used because the file extension is different.

3. Build and Install

   Copy

   xtables

   :

   • Navigate to the extracted folder:

     bashCopy
     cd <extracted_folder>
     

   • Run the following commands:

     bashCopy
     sudo ./configure
     sudo make
     sudo make install
     

   • Verify installation:

     bashCopy
     ls -l /usr/local/libexec/xtables-addons/
     

4. Create Directory for GeoIP Database:

   • Create a working directory for GeoIP:

     bashCopy
     mkdir xtables
     cd xtables
     

   • Download the GeoIP database:

     bashCopy
     /usr/local/libexec/xtables-addons/xt_geoip_dl
     ls -l
     

   • Create the GeoIP directory:

     bashCopy
     sudo mkdir /usr/share/xt_geoip
     

     Note: The directory name must be

     Copy

     xt_geoip

     .

5. Process GeoIP Database:

   • Ensure you are in the

     Copy

     xtables

     directory:

     bashCopy
     cd xtables
     

   • Build the GeoIP database:

     bashCopy
     sudo /usr/local/libexec/xtables-addons/xt_geoip_build -D /usr/share/xt_geoip/ *.csv
     

   • Verify database creation:

     bashCopy
     ls -l
     

     This command will add entries to the GeoIP directory. If no

     Copy

     .csv

     file is present, it won't work.

6. Handle Errors:

   • If any error occurs, restart the process from step 1.

7. Verify GeoIP Module:

   • Test the GeoIP module (this will initially throw an error):

     bashCopy
     sudo iptables -m geoip -h
     

8. Load GeoIP Dependencies:

   • Load dependencies into memory using:

     bashCopy
     sudo depmod -a
     

   • Retry the GeoIP test:

     bashCopy
     sudo iptables -m geoip -h
     

9. Traffic Blocking and Logging:

   • Do NOT Run: Command to drop packets from China:

     bashCopy
     sudo iptables -A INPUT -m geoip --src-cc CN -j DROP
     

   • Run This Instead: Command to log packets from China:

     bashCopy
     sudo iptables -A INPUT -m geoip --src-cc CN -j LOG --log-level debug --log-prefix "| Kuch Bhi China |"
     

     This will redirect Chinese traffic to the logs with a debug level and a prefix

     Copy

     Kuch Bhi

     .

10. View Iptables Rules:

    bashCopy
    sudo iptables -L
    

11. Monitor Logs in Real-Time:

    bashCopy
    sudo journalctl -f
    

    This command displays logs in real-time.

DIY Task:

• Research how to generate an IP address from China for testing purposes.