Set up MaxMind GeoIP Blocking in OPNsense (2024)

OPNsense

If you're looking for an example of whitelisting inOPNsense, take a look at this guide

Whitelist countries in OPNsense using MaxMind GeoIP and firewall aliases
https://techlabs.blog/categories/opnsense/whitelist-countries-in-opnsense-using-maxmind-geoip-and-firewall-aliases

Enter Database URL
You'llneed to replaceYOUR_LICENSE_KEY

https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country-CSV&license_key=YOUR_LICENSE_KEY&suffix=zip

OPNsense

Hi - this is a really great cookbook and I was so happy to discover it. I did everything, generated the license file at maxmind, followed EXACTLY your screenshots but when I have entered the database url with my generated licsense at the GeoIP Tab in the URL Field it doesn't work. No Error Message - nothing. The last updated field remains empty and no message as you claimed "The GeoIP country list has updated successfully". When I enter this URL, which I have entered in the URL Field in my Chrome Browser the files are download completly correct to the download folder. [link removed](I did not show my license key here ... )I am using the brand new version of opnsense Version22.1.2_1. Do you have any clue why this doesn't work? could it be the new version?Thank You - Screenshots here [link removed]

TechLabson Saturday, 05 March 2022 20:39

Hi Joerg, when you generated the license key, did you select the option "Will this key be used for GeoIP update - No"?
I have Maxmind GeoIP blocking working on Opensense version 22.1.2_1, so I don't think that's the issue.
Also, the download URL you are using has ASN instead of Country.
Can you please try going through the steps for "Generate a license key" and "Get the URL for GeoIP database updates" again?
I hope that helps. Good luck!

Hi Joerg, when you generated the license key, did you select the option "Will this key be used for GeoIP update - No"?I have Maxmind GeoIP blocking working on Opensense version 22.1.2_1, so I don't think that's the issue.Also, the download URL you are using has ASN instead of Country.Can you please try going through the steps for "Generate a license key" and "Get the URL for GeoIP database updates" again?I hope that helps. Good luck!

Thanks mate for the quick reply, I really apprecite that. Your hint regarding using ASN instead of Country in the URL did make things clearer. It is working now :-) There is a little mistake in your cookbook - when you take a look at the page where you come to the point "Get the URL for GeoIP database update" - one can see on your screenshot that you recommend using "GeoLite2 ASN: CSV Format" instead of "GeoLite2 Country: CSV Format". In the further course your URL is correct, but I was misled by the screenshot. Thanks for your help and maybe you consider to change that screenshot in your cookbook. Stay safe !!

TechLabson Tuesday, 08 March 2022 19:37

Hi again, thank you for the feedback! I have updated the screenshots in the guide. Glad you were able to get it working

Hi again, thank you for the feedback! I have updated the screenshots in the guide. Glad you were able to get it working :)

Hi,
I've been using this method since late feb. 2022 - works wonders.
Do you know if it *just works* if I opt for the full GeoIP2-Country (ie. not the Lite-version)?
(ie. do I just need to update the download URL?)

Hi,I've been using this method since late feb. 2022 - works wonders.Do you know if it *just works* if I opt for the full GeoIP2-Country (ie. not the Lite-version)?(ie. do I just need to update the download URL?)

TechLabson Tuesday, 19 April 2022 20:15

Hi Kim, I haven't tried this with MaxMind GeoIP2 paid products, but I think you are correct. You will just need to update the database URL. Please reply back and let me know if it works? Thanks

Hi Kim, I haven't tried this with MaxMind GeoIP2 paid products, but I think you are correct. You will just need to update the database URL. Please reply back and let me know if it works? Thanks

Works fine with the 'regular' GeoIP2-Country db :)https://download.maxmind.com/app/geoip_download?edition_id=GeoIP2-Country-CSV&license_key=&suffix=zip

hi thanks for this post. i did everything as described and for testing, i enabled all countries for the block list even in the country where i life. but i'm still able to access the webserver i published over nginx... does this not work when nginex is used? i guess it should because the fw block rule is before the rules which allow nginex access....

hi thanks for this post. i did everything as described and for testing, i enabled all countries for the block list even in the country where i life. but i'm still able to access the webserver i published over nginx... does this not work when nginex is used? i guess it should because the fw block rule is before the rules which allow nginex access....

Guest - Docon Saturday, 15 October 2022 15:16

How would you just choose the country you want to allow, but block everything else? The tip from the website is what I am trying to do.Geo ip lists can be rather large, especially when using IPv6. When creating rules, always try to minimize the number of addresses needed in your selection. A selection of all countries in the world not being the Netherlands can usually be rewritten as only addresses from the Netherlands for example.

TechLabson Monday, 06 February 2023 20:39

Hi, finally found time to finish writing this guide on Whitelisting in OPNsense. Hope you find it useful! Whitelist countries in OPNsense using MaxMind GeoIP and firewall aliases[url=https://techlabs.blog/categories/opnsense/whitelist-countries-in-opnsense-using-maxmind-geoip-and-firewall-aliases]https://techlabs.blog/categories/opnsense/whitelist-countries-in-opnsense-using-maxmind-geoip-and-firewall-aliases[/url]