Gentoo IPTables Xtables-addons Block countries

WHY

Because there are kinda' tons of infected japan and pakistan computers which try to send spam to me ( or use me as a relay ). My postfix is set up to block relay but that still has to check against dnsbl lists for each ip.

HOW

Use geoip with iptables !

I'm using gentoo so patch-o-matic doesn't seem to be integrated yet.

Step 1. Get the latest patch-o-matic from http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ and pack

Step 2. Find out what iptables version you have

emerge iptables -vp

Step 3. Get the source for your version, unpack and compile ( replace 1.4.6 with your version you got from above )

ebuild /usr/portage/net-firewall/iptables/iptables-1.4.6.ebuild unpack

Step 4. Go to your unpacked patch-o-matic dir and do

./runme --download
IPTABLES_DIR=/var/tmp/portage/net-firewall/iptables-1.4.6/work/iptables-1.6 KERNEL_DIR=/usr/src/linux ./runme geoip

Step 5. Go to /usr/src/linux and enable geoip as module and recompile ( I do make uImage because I'm using gentoo on an ARM arch here .. you don't need that stuff .. )

cd /usr/src/linux
make menuconfig

# Symbol: NETFILTER_XT_MATCH_GEOIP[=m]
# Prompt: "geoip" match support
# -> [*] Networking support (NET [=y])
#  -> Networking options  
#    -> [*] Network packet filtering framework (Netfilter) (NETFILTER [=y])
#      -> Core Netfilter Configuration
#       -> -*- Netfilter Xtables support (required for ip_tables) (NETFILTER_XTABLES [=y])
#        -> <M> "geoip" match support Symbol: NETFILTER_XT_MATCH_GEOIP [=m]
#
# CONFIG_NETFILTER_XT_MATCH_GEOIP:
# This option allows you to match a packet by its source or
# destination country.  Basically, you need a country's
# database containing all subnets and associated countries.
# For the complete procedure and understanding, read :
# http://people.netfilter.org/acidfu/geoip/howto/geoip-HOWTO.html   

make uImage && make modules && make modules_install

Step 6. Fixing the patch because for some reason the patch doesn't put a header file where it's supposed to .. so .. cd to the patch-o-matic directory and do this:

cp ./patchlets/geoip/linux-2.6/include/linux/netfilter/xt_geoip.h /var/tmp/portage/net-firewall/iptables-1.4.6/work/iptables-1.4.6/include/linux/netfilter/

Add this at the beginning of /var/tmp/portage/net-firewall/iptables-1.4.6/work/iptables-1.4.6/include/linux/netfilter/xt_geoip.h

1. define IPTABLES_VERSION "1.4.6"

Step 7 . Install the newly patched iptables

ebuild /usr/portage/net-firewall/iptables/iptables-1.4.6.ebuild compile
ebuild /usr/portage/net-firewall/iptables/iptables-1.4.6.ebuild install
ebuild /usr/portage/net-firewall/iptables/iptables-1.4.6.ebuild qmerge

Examples and many thanks to: peejix's HowTo.

And you're done