Closed
Description
I tried to block IPs from a specific country but GeoLookup does not work.
- OS: Ubuntu 16.04.5 LTS
- modsecurity v3.0.3
- modSecurity-nginx v1.0.0
- nginx v1.14.0
- libgeoip1, libgeoip-dev, geoip-bin was installed
nginx virtual host
modsecurity on;
modsecurity_rules '
# Include the recommended configuration
Include /etc/nginx/modsec/modsecurity.conf
# OWASP CRS v3 rules
Include /usr/local/owasp-modsecurity-crs-3.0.0/crs-setup.conf
Include /usr/local/owasp-modsecurity-crs-3.0.0/rules/*.conf
# Audit log
SecAuditLog /var/log/modsec/mysite.com/audit.log
# Custom rules
Include /etc/nginx/modsec/mysite.com/*.conf
';
/usr/local/owasp-modsecurity-crs-3.0.0/crs-setup.conf
...
SecGeoLookupDB util/geo-location/GeoIP.dat
...
/etc/nginx/modsec/mysite.com/main.conf
SecRule REMOTE_ADDR "@geoLookup" "chain,id:1,drop,msg:'Non-VN IP address'"
SecRule GEO:COUNTRY_CODE "!@streq VN"
And the debug log I got
[4] (Rule: 1) Executing operator "GeoLookup against REMOTE_ADDR.
[9] Target value: "x.x.x.x" (Variable: REMOTE_ADDR)
[4] Rule returned 0.
This means the remote address could not be looked up. Is there anyone can tell me what is wrong here?