Is it possible to see a list of countries that are making connections into the server?

[roadhazard]

Recently discovered this project and I think it's amazing!

One question.... would it be possible to add some functionality that will record a list of countries that made (OR ATTEMPTED TO MAKE) a connection into my server?

Previously, I was using Untangle firewall. One of the things I would do with it is check the log files from time to time and look for foreign countries that made attempts to connect to my Plex server and then added those countries to the block list.

If geoip-shell kept a list of countries where connections were coming from, I think that would be a nice add. As admins, we could check this log file and see where traffic is coming from.

But if there's 507 connections from the US, don't add 507 lines, maybe do something like this:

US, 507 (Put it on a single line to indicate 507 connections from US based IP addresses. This will help keep the file small and easily read). It could be a rolling txt file and maybe keep 2 days worth of info?

[friendly-bits]

Hi, thanks for the kind words. I'll look into implementing this functionality. Probably will take some time, because I am currently implementing support for outbound geoblocking (in addition to the existing inbound geoblocking functionality). It's a rather big change which will probably take a while to finalize and debug. Once that's done, I'll be open to implementing additional features.

[roadhazard]

Ok, thanks for the reply and no hurry on implementing this. Have a great day!

[friendly-bits]

Looking into this, I can think of 3 possible ways to implement this sort of functionality:

1. Real-time logging of dropped ip addresses which should be relatively computationally and memory-consumption-wise inexpensive. Then you could use another app to process the logs and map the logged ip addresses to countries.
2. Real-time logging of dropped ip address + origin country - this would require to load a (relatively) large map of all ip ranges in all countries (consuming much more memory) and then each dropped ip address would be looked up in that map in real time (computationally expensive operation). I'm not sure if this is doable with iptables but there is a way to implement this with nftables.
3. Real-time logging of dropped ip addresses only (as in first option), and then implementing log processing and ip-address-to-country mapping functionality in geoip-shell, which would run periodically (say once a day). This would still require to temporarily load all known ip ranges into memory and may require quite a bit of system memory at that time (not sure how much before testing) and then map all logged ip's to these ranges, which may or may not be a computationally expensive task, depending on the volume of the ip addresses and the CPU. The benefit of this approach vs the 2nd option is that your firewall is much less likely to get overwhelmed by processing a large number of dropped requests in real time (a.k.a denial of service).

Which sort of logging do you think would be most useful?