Jump to content

FreeBSD ~ PF Firewall With GEO Block


Recommended Posts

  • Bot

Hello community,

About Firewall
This firewall is ideal for those who have a national server and not an international server.
It is based on GEO block, adding new countries or removing them is extremely easy.
Currently I can easily say that it is the best pf that is published for free at the level of efficiency.
I attacked the firewall several times, it was tested on online servers with 700/800 simultaneous players and it worked efficiently without problems.

Warning
The best protection that can be applied is at the network level.
there is no point in having 1 firewall running on an operating system if the network does not support a large amount of traffic for the operating system's firewall to be able to act.
This firewall in combination with a good VPS/dedicated VPS and good network protection on the company side can easily handle small to medium attacks.
All the magic happens because of GEO BLOCK, without GEO BLOCK it is equivalent to the pf's shared here in the community.

The code is not optimally organized and can be improved, remembering that it was my first version.

Requirements
-pftop (PF)
-wget
 
How To Setup

This is the hidden content, please

Questions? Comment, as soon as possible I will answer.

Best Regards,
Papix

  • Metin2 Dev 89
  • kekw 1
  • Eyes 3
  • Dislove 1
  • Angry 1
  • Not Good 1
  • Think 1
  • Confused 2
  • Good 31
  • Love 6
  • Love 31

english_banner.gif

Link to comment
Share on other sites

  • 1 month later...
  • Premium

It's a good strategy against botnets, but let's not forget that processing rules also consumes resources and comparing every IP against some large database might not be the greatest idea as a botnet with many members could potentially be able to take down your server faster than not using a geo block as pf becomes the bottleneck itself.

It is more efficient in this scenario to whitelist the countries that we do want to allow and have a blanket block for everything else.

Also what do you need to install wget for? FreeBSD has its own native utility, fetch.

 

  • Metin2 Dev 1
  • Good 1
Link to comment
Share on other sites

  • Premium
1 hour ago, Shogun said:

It's a good strategy against botnets, but let's not forget that processing rules also consumes resources and comparing every IP against some large database might not be the greatest idea as a botnet with many members could potentially be able to take down your server faster than not using a geo block as pf becomes the bottleneck itself.

It is more efficient in this scenario to whitelist the countries that we do want to allow and have a blanket block for everything else.

Also what do you need to install wget for? FreeBSD has its own native utility, fetch.

 

Nice reply. However that's not even efficient, they randomize the localization of course.

Link to comment
Share on other sites

  • Premium
10 hours ago, WeedHex said:

Nice reply. However that's not even efficient, they randomize the localization of course.

Point 1. You have a botnet attacking you. In that botnet, there will be IP addresses from all over the world. If you can limit access to countries where you know your users will be, then you are leaving a part of the botnet out hence less packets hitting whatever they are trying to hit.

But that's not the discussion here.

PF is not a hardware firewall but it's usually and in the cases we discuss in this forum running on the same system you try to protect and consuming its resources while it processes rules.

Hence it's in our interest that these rules are processed as quickly as possible.

Given that the list of IPs or subnets we want to block is much larger than the list of subnets we want to allow, it makes sense to have PF check any connecting IP against the later list because that will be faster - and then block everything else.

  • Love 1
Link to comment
Share on other sites

  • 3 weeks later...
On 7/4/2022 at 9:40 AM, Shogun said:

Point 1. You have a botnet attacking you. In that botnet, there will be IP addresses from all over the world. If you can limit access to countries where you know your users will be, then you are leaving a part of the botnet out hence less packets hitting whatever they are trying to hit.

But that's not the discussion here.

PF is not a hardware firewall but it's usually and in the cases we discuss in this forum running on the same system you try to protect and consuming its resources while it processes rules.

Hence it's in our interest that these rules are processed as quickly as possible.

Given that the list of IPs or subnets we want to block is much larger than the list of subnets we want to allow, it makes sense to have PF check any connecting IP against the later list because that will be faster - and then block everything else.

I think it won't be such big problem since , countries subnets are a constant number , so the complexity will be O(N).

Also maybe pf uses some type of hashtable/hashmap about subnets , so it could access in O(1) in the data.(yy u 'll maybe waste some more RAM in such case xD)

Edited by dotMatryx
Link to comment
Share on other sites

  • Premium
22 hours ago, dotMatryx said:

I think it won't be such big problem since , countries subnets are a constant number , so the complexity will be O(N).

Also maybe pf uses some type of hashtable/hashmap about subnets , so it could access in O(1) in the data.(yy u 'll maybe waste some more RAM in such case xD)

Country subnets are not constant. They change. If you want properly updated subnet lists, it may even cost you money. In any case, my point is a blacklist will have more IPs than a whitelist and therefore be slower to process, because there are more countries to block than not (your expected players are not going to be spread over half the world I presume)

This is not trivial when you are being flooded.

Link to comment
Share on other sites

6 minutes ago, Shogun said:

Country subnets are not constant. They change. If you want properly updated subnet lists, it may even cost you money. In any case, my point is a blacklist will have more IPs than a whitelist and therefore be slower to process, because there are more countries to block than not (your expected players are not going to be spread over half the world I presume)

This is not trivial when you are being flooded.

Didn't know that they are not constant , thanks for this information.

Anyway even they are not constant , if you pay in memory you won't be slowed (in high level ) because pf may use a data structure like hash table , so it will do only one compare instead of N compares.

In conclusion better having a white list if you don't want to throw memory.

  • Metin2 Dev 1
Link to comment
Share on other sites

  • 8 months later...

Announcements



  • Similar Content

  • Similar Content

  • Similar Content

  • Tags

  • Activity

    1. 5

      Effect weapons

    2. 3

      Crystal Metinstone

    3. 3

      Feeding game source to LLM

    4. 113

      Ulthar SF V2 (TMP4 Base)

    5. 3

      Feeding game source to LLM

    6. 0

      Target Information System

    7. 3

      Feeding game source to LLM

    8. 2

      anti exp explanation pls

  • Recently Browsing

    • No registered users viewing this page.
×
×
  • Create New...

Important Information

Terms of Use / Privacy Policy / Guidelines / We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.