Koozali.org: home of the SME Server

Contribs.org Forums => Koozali SME Server 10.x Contribs => Topic started by: philippe971 on July 27, 2024, 08:08:26 PM

Title: xt_geoip ERROR_COUNTRY_MAX
Post by: philippe971 on July 27, 2024, 08:08:26 PM

Bonjour
Concernant la contrib Xt geoip, y a-t-il un moyen de dépasser la limite du nombre de pays bloqués ?
Merci

Title: Re: xt_geoip ERROR_COUNTRY_MAX
Post by: ReetP on July 28, 2024, 12:21:51 AM

Take a few steps back.

Describe your server. Version etc.

Describe where you saw the error - I have never seen it?

Paste the output from these:

Code: [Select]

config show geoip

Code: [Select]

config show | grep -i countries

Title: Re: xt_geoip ERROR_COUNTRY_MAX
Post by: philippe971 on July 28, 2024, 02:17:52 AM

Le serveur est en version 10.1
La contrib Xt geoip fonctionne parfaitement, mais il est impossible de mettre plus de 50 pays
Lorsqu'on dépasse 50 pays, il y a une erreur ERROR_COUNTRY_MAX, comme l'indique https://wiki.koozali.org/Xt_geoip#global_masq_properties (https://wiki.koozali.org/Xt_geoip#global_masq_properties) 50 pays max
Y a-t-il un moyen de dépasser la limite du nombre de pays bloqués ?

Title: Re: xt_geoip ERROR_COUNTRY_MAX
Post by: ReetP on July 28, 2024, 02:31:34 AM

I don't know if that is a limitation of the contrib or something else, but if you need more then use 'reverse' so you 'permit selected' rather than 'deny many'.

Some of mine simply have

!GB,ES,FR

Much easier to manage.

Title: Re: xt_geoip ERROR_COUNTRY_MAX
Post by: philippe971 on July 28, 2024, 02:37:36 AM

Merci pour la réponse, je vais regarder ça.

Title: Re: xt_geoip ERROR_COUNTRY_MAX
Post by: Jean-Philippe Pialasse on July 30, 2024, 07:24:06 PM

un maximum de pays est fixé pour éviter de surcharger iptables et ralentir la connexion via le filtrage.
comme le pointe Reetp, une approche securitaire est de changer le sens de reflection et de n'autoriser que certains pays au lieu d'interdire presque tous.
pour info par default la limite est 15, nous l'avons deja augmenté a 50  lors de la compilation.

a maximum number of country has been set in order to not slow down your connexion because of iptables and filtering process.
As pointed by Reetp, a safe alternative is to negate the string and only authorize few countries rather that refuse most of them.
For your information the default is set to 15, and we pushed that to 50 at compilation.