Geographic IP filtering in Suricata compatible rule groups
Use geographic IP or geo IP filtering to filter on country codes for the IP addresses of network traffic. You can use geo IP filtering with Suricata compatible rule strings and with the standard Network Firewall stateful rule groups.
Suricata supports filtering for source and destination IPs. You can filter on either of these types by itself, by specifying dest
or src
. You can filter on the two types together with AND or OR logic, by specifying both
or any
.
For more information see the Suricata geoip
keyword documentation at
IP Keywords: geoip
To use a geo IP filter, you provide the geoip
keyword, the filter type, and the country codes for the countries that
you want to filter for, for example geoip: dest,CN,US;
. For additional examples, see Stateful rules examples: geo IP filter.
For more information about adding geo IP filtering to your Suricata compatible rule groups via the console, see the Creating a stateful rule group procedure.
IPv4 and IPv6 support
The Network Firewall implementation of Suricata geoip
provides support for IPv6 and IPv4. This is an expansion
of the support provided by Suricata.
MaxMind IP geolocation
Suricata determines the location of requests using MaxMind GeoIP databases.
MaxMind reports very high accuracy of their data at the country level, although accuracy varies according to factors such as country and type of IP.
For more information about MaxMind, see MaxMind IP Geolocation
If you think any of the GeoIP data is incorrect, you can submit a correction request
to Maxmind at MaxMind Correct GeoIP2 Data
Country codes
IP geolocation uses the alpha-2 country codes from the International Organization for Standardization (ISO) 3166 standard.
-
You can search country codes at the ISO website, at ISO Online Browsing Platform (OBP)
. -
You can also find them listed on Wikipedia, at ISO 3166-2
.
Network Firewall only allows you to save geo IP filter rules that have valid country codes.