Dear #infosec friends - I have a requirement from work to block IPs based on a specific subset of countries and territories.

Carl

Dear #infosec friends - I have a requirement from work to block IPs based on a specific subset of countries and territories. MaxMind was the first thing I thought of, but it's fairly unreliable in my experience. Is there a better way to determine these deny-lists based on ASN or some other more real-time solution?

cR0w

@edolnx I don't know of an existing reliable solution, but I think @ryanc deployed one in the past. Maybe they have some pointers.

Ryan Castellucci :nonbinary_flag:

@cR0w @edolnx If it's a compliance requirement, just use MaxMind.

If that is not good enough, I don't know what would be. I can tell you how to check BGP data in near real time, but ASN registration data is not always accurate, and originating ASN can be faked (I've seen it done).

If I deeply cared about this I would probably run traceroutes to the IP in question from a bunch of known reference points and trilaterate (there is a published paper about this, nobody's bothered to commercialize it AFAIK), but then you need to wait a nontrivial amount of time (half a second minimum) for the data.

Also, it would make network operators mad.