We have a new internet connection since a month, and the external ip adress of that line is not in the correct country.
We have ip 18.104.22.168 and acording to the ripe database it's in the Netherlands and that's correct. Only our branch office Sophos XG says the IP is Italian.
% This is the RIPE Database query service.
% The objects are in RPSL format.
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '22.214.171.124 - 126.96.36.199'
% Abuse contact for '188.8.131.52 - 184.108.40.206' is 'firstname.lastname@example.org'
inetnum: 220.127.116.11 - 18.104.22.168
status: ALLOCATED PA
source: RIPESophos XG:Where does the XG get's it's info and why is this incorrect?Bart.
SFOS uses maxmind.
Maxmind is claiming Italy: https://www.maxmind.com/en/geoip-demo
You can do a change request to maxmind and this will be reflected to SFOS as well. www.maxmind.com/.../geoip-data-correction-request
Hi LuCar Toni ,
Thaks for your reply. I will check with them.
Bart van der Horst
Sophos XG v18(.5) / v19 Certified Architecthttps://www.bpaz.nl
Hi LuCar Toni
I've got a problem with this. Checked out there website, and it seems to be possible to defeat this system. Say I've blocked Russia to access userportal.
Someone from Russia can access this site and claim their IP is form, say Paris, now this service will update their database and the Sophos XG will no longer block that IP.
So this is not waterproof at all.
I know this site is more accurate in exact location, but I'm not interested in what city or locality, the IP is from, but I do want to know what country.
Shouldn't it be fed by the ripe db instead? It's more accurate on provider location.
Mabey something to think about.
GEOIP is not a security feature.
It never was and it never will be.
And actually if you want to workaround this, you will start a VPN client and easily exploit this system. So GEOIP is something to nail down a reporting database.
But maxmind as a vendor has some feedback about there data: https://support.maxmind.com/hc/en-us/articles/4407630607131-Geolocation-Accuracy
Personally i am not a friend of geoip blocking, as i am not seeing the value in it. There are actually 10 ways i can workaround this in one second. So what is the point? Some say: to get the noise of the internet to a minimum: Yeah fair enough, the database is fine for this Purpose.
But if an attacker wants to exploit you, they will not use there real IP in any way, they will use masq ips, as this is the most secure way for them. And Maxmind claims to do checks for there data as well. They will not simply move this because of somebody claiming the data was not right.