Re: Geo Blocking with new maxmind Database

Dear Blason,

This is how I am using with Apache 2.4 and modsec 2.9.3

SecGeoLookupDb /File-path-for-maxmind4.dat/maxmind4.dat
SecRule REMOTE_ADDR "@geoLookup" "phase:1,chain,id:28,drop,msg:'Geolocation
Blocked'"
SecRule GEO:COUNTRY_CODE "@pm PK CN PE"

Yes with modsec 2.9 you need the db file in legacy dat format.
On searching it on google I found this third party URL where maxmind db
file in DAT format is available.

https://dl.miyuru.lk/geoip/maxmind/city/maxmind4.dat.gz

Hope this helps

Thanks,
Homesh




On Mon, Apr 13, 2020 at 6:15 PM Blason R <[email protected]> wrote:

> Hi Folks,
>
> Can someone please divert me to the documentation for configuring Geo
> blocking with CRS modsec rules? I tried downloading the maxmind db but
>
> 1. After change of maxmind DB what is the way to download the maxmind
> GeoIP2 database? How can we enable scheduling as well?
> 2. Since default GeoIpv2 downloads in .mmdb format I guess nginx refuse to
> start
>
> Nginx 1.17.9
> Modsec 3.2.0
>
> TIA
> blason R
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/