An idea is to get a bgp feed from your isp and use something like this (I use FreeBSD so ipfw in my case, however you could use it for a .htaccess or anything) Once your BGP is established, run: vtysh -e "show ip bgp" > /root/scripts/bgproutes.txt ################ #!/bin/sh for i in `cat /root/scripts/bgproutes.txt | grep -v 0.0.0.0 |awk '{print($2)}' | grep -v "127.0.0.1" | grep -v "1996-200" | grep "[0-255]." ` ; do ipfw add 01002 deny ip from $i to any in done ################ With a few changes of the above script you could get a .htaccess file in the below format: <Limit GET POST> order deny,allow deny from all allow from $i </Limit> Barry ----- Original Message ----- From: "Liz Q" To: Sent: Thursday, June 30, 2005 9:41 AM Subject: Re: [nznog] NZ IP-Range

On Thu, 30 Jun 2005 09:00, James J. Guidera wrote:

...

Just a quick question,

Is there a singular complete list of NZ ip range?? I am wanting to allow only NZ traffic access to servers.

/usr/bin/wget ftp://ftp.apnic.net/pub/apnic/dbase/data/country-ipv4.lst -O /tmp/country-ipv4.lst

for NZIP in `cat /tmp/country-ipv4.lst |grep nz | awk '{print $5}'` ; do echo Allowing ${NZIP} ${IPTABLES} -t filter -A INETIN -p tcp --sport 20 --dport 1024:65535 -s $NZIP -j TCPACCEPT

done

Probably an easier way to do it somewhere, but that works for me ;]

Liz

...

Thanks

James Guidera

Systems Engineer

Miracle Electronics Ltd

Ph:+64-4-385-1293

Cel: +64-21-705-614

-- It's been discovered that research causes cancer in rats.

_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

Steve Phillips wrote:

Just be aware that these solutions will give you a list of "NZ IP Ranges" but may not be New Zealand based netwise.

If you are looking for traffic originating in NZ and not traversing any international links then thats an entirely different story and only your ISP can provide you with this.

If this is a bill saving exercise then it may pay to be a little prudent.

I echo Steve's warning. It really depends how relaible you need the data to be. Back in the days when everything went throug NZGate at Waikato they kept lists of NZ addresses based upon the BGP tables. These contain quite a few small blocks of non NZ addresses -- mainly belonging to large multination companies and Telcos. I imagine it has got worse not better. If accuracy is crucial then you really need something based on the routing tables that gets updated frequently. Russell

On Thu, 30 Jun 2005 10:47, James Riden wrote:

nz.countries.nerd.dk is a DNSBL-type list - I think there is a mod_dnsbl for apache which will allow you to query this kind of list and do accept/reject based on the results.

I'm not sure how accurate the list is, and their DNS for the website seems to be down at the moment.

Sounds handy. You could probably even write a quick perl or c program using libgeoip[1] or a perl module[2] . Although i havnt looked into how they get their country name from the ip (it may be similar to the apnic lists and not work for some people) Liz [1] http://www.maxmind.com/app/c [2] http://search.cpan.org/search?query=geoip&mode=all -- I started out with nothing, and I still have most of it.