geoip for iptables ?

[Sylphia]

I'm running Merlin's 376.49_5 firmware on an ac-68u.

Is there geoip support for iptables?
If not, any tutorials for me to build firmware from source code to enable it?

I'm a programmer, but lacks knowledge of linux programming...

Thanks.

 

[Sylphia]

Anyone familiar with building kernel modules?
I tried, but no luck.( spent me 3 hours to get 378.50 final compiled successfully )

Still,

'iptables -m geoip -h'

gives right help message but when execute something like

'iptables -A INPUT -m geoip --dst-cc US -j RETURN'

fails with no match found with that name. And no geoip module found in
cat /proc/net/ip_tables_matches

I have to add about 5k rules to iptables without geoip, and it takes ~2 minutes to finish that iptables adding script...

 

[buddyp]

Anyone familiar with building kernel modules?
I tried, but no luck.( spent me 3 hours to get 378.50 final compiled successfully )

Still,

'iptables -m geoip -h'

gives right help message but when execute something like

'iptables -A INPUT -m geoip --dst-cc US -j RETURN'

fails with no match found with that name. And no geoip module found in
cat /proc/net/ip_tables_matches

In my version of asuswrt-merlin (376.49_5++) the xt_geoip.ko module is included in the flash image, however, the shared library (libipt_geoip.so) that iptables uses to access it is missing, as well as the database. I looked into it a bit, and geoip was commented out in the iptables makefile, so I uncommented it and built a new version and the library was created. I copied the library and the database to the router's /tmp and with a little LD_LIBRARY_PATH hocus-pocus I was able to add geoip rules and they appear to work correctly.

I am going to think a bit about about how to go about making this work out of the box, in a manner of speaking, for my customized version of asuswrt-merlin, as I am currently running geoip rules on all my linux based endpoints, but it would be nice to protect everything behind the firewall.

 

[hardtotell]

Does this still work, even if a guy were to route his traffic through 7 proxies to visit yor website?