GeoIP Blocking in OPNsense

GeoIP blocking is a powerful feature in OPNsense that allows administrators to restrict network traffic based on geographic location. This can significantly enhance security by preventing unauthorized or malicious access from high-risk countries. By using MaxMind’s GeoLite2 databases, OPNsense makes it simple to set up and manage GeoIP blocking rules.

This guide walks you through the steps to enable, configure, and use GeoIP blocking in OPNsense effectively.

Step 1: Obtain a MaxMind GeoIP Database Key

1. Create a MaxMind Account:
   • Visit MaxMind’s Website and create a free account.
2. Generate a License Key:
   • After logging in, go to My License Key in your MaxMind account.
   • Click on Generate New License Key and provide a description for the key.
   • Enable GeoLite2 access and save the generated key.

Step 2: Configure MaxMind in OPNsense

1. Access the OPNsense Web Interface:
   • Log in to the OPNsense dashboard using your credentials.
2. Navigate to the GeoIP Settings:
   • In the top menu, go to Firewall > Aliases.
   • Open the GeoIP Settings tab.
3. Generate the Download Link for the Database:
   • MaxMind requires a specific download link to retrieve the GeoLite2 database.
   • Replace the placeholders in the following URL with your AccountID and LicenseKey obtained from MaxMind:
     https://AccountID:[email protected]/geoip/databases/GeoLite2-Country-CSV/download?suffix=zip
     • AccountID: Found in your MaxMind account under your profile or license key section.
     • LicenseKey: The key generated in the MaxMind portal during registration.
   • Example: If your AccountID is 12345 and your LicenseKey is abcd1234, the URL would look like this:
     https://12345:[email protected]/geoip/databases/GeoLite2-Country-CSV/download?suffix=zip
4. Paste the Download Link in OPNsense:
   • In the GeoIP Settings tab, locate the field for the MaxMind database link.
   • Paste the generated URL into this field.
5. Save and Download the Database:
   • Click Save to store the settings.
   • OPNsense will use the URL to download the GeoLite2 database. This process might take a few minutes.
6. Verify the Database Installation:
   • After the download completes, confirm the database status in the GeoIP Settings tab.
   • Ensure the database is up to date and that there are no errors during the download or extraction.

Step 3: Create a GeoIP Alias

1. Go to Aliases:
   • Navigate to Firewall > Aliases and click on + Add.
2. Configure the Alias:
   • Name: Enter a descriptive name for the alias, such as Block_Countries.
   • Type: Select GeoIP from the Type dropdown menu.
   • Content: Choose the countries you want to block or allow from the list.
   • Description: Add a brief description for the alias, e.g., “Blocking traffic from selected high-risk countries.”
3. Save the Alias:
   • Click Save to create the GeoIP alias.

Step 4: Apply GeoIP Blocking to Firewall Rules

1. Navigate to Firewall Rules:
   • Go to Firewall > Rules and select the interface where you want to apply the rule (e.g., WAN).
2. Add a New Rule:
   • Click + Add to create a new firewall rule.
3. Configure the Rule:
   • Action: Set the action to Block or Reject.
   • Source: Select the GeoIP alias you created earlier (Block_Countries).
   • Destination: Set this to your internal network or leave it as Any for global blocking.
   • Description: Add a description, e.g., “Block traffic from high-risk countries.”
4. Save and Apply:
   • Click Save and apply the changes by clicking Apply Changes.

Step 5: Test Your GeoIP Blocking Configuration

1. Verify the Rule:
   • Navigate to Firewall > Log Files > Live View to monitor traffic and ensure the rule is working as expected.
   • Check that traffic from the blocked countries is being dropped or rejected.
2. Adjust as Needed:
   • If legitimate traffic is being blocked, update the GeoIP alias to exclude the affected countries or refine the rule conditions.

Benefits of GeoIP Blocking

• Enhanced Security: Prevent unauthorized access from high-risk geographic locations.
• Reduced Attack Surface: Limit exposure to specific countries based on risk profiles.
• Customizable Rules: Tailor rules to your organization’s needs, allowing or blocking traffic from specific countries.

Conclusion

GeoIP blocking in OPNsense is a robust feature that enhances network security by restricting access based on geographic location. By following this detailed guide, you can easily set up and manage GeoIP rules, ensuring your network is protected from threats originating in specific regions. Always test your configuration to ensure it meets your security needs without disrupting legitimate traffic.

For more information, refer to the official OPNsense GeoIP documentation.