Testing our configurations

[datishans]

Hi,

After installing my geo blocking config, the first question I had was: How to I test/verify/confirm that I'm now blocking country X,Y and Z.

The most obvious route would be a VPN or a 'test my site'-website.

...but I'm looking for a solution that integrates into geoip-shell, so that we don't have to buy/sign in/retry our VPN connections on our own.

For example, we could crowdsource/fund a bunch of VPS's around the world. Each VPS would then host a simple "test my server"-endpoint that curls your server. A command like geoip-shell test from="NL, BE, CN, US" would then report back to you how your block is behaving from those 4 countries.

Would love to discuss options & ideas here!

[friendly-bits]

Hi @datishans , I don't think that the idea of renting VPS around the world (and crowd-funding this endeavor) is feasible for a small project with relatively few users, such as geoip-shell. That said, I suppose it would be possible to implement sort of an automated test of inbound geoblocking. Basically what I'm thinking is this:

• The user specifies an IP address belonging to the IP block of the country they want to test against.
• geoip-shell attempts to ping the specified IP address - this is to confirm that the address responds to ping requests
• geoip-shell temporarily removes the firewall rule which allows established/related connections
• Then geoip-shell attempts to connect to ping the specified IP address again - with established/related connections disallowed, the pings should time out
• Last thing, geoip-shell restores the established/related firewall rule
• If the pings timed out at the second attempt (but not on the first one) then geoblocking is working correctly

This would require the user to come up with an IP address in another country which normally responds to pings, so it's not 100% automatic and fool-proof, but this is the only idea I can come up with which is feasible to implement. Do you think this would help?

[datishans]

Ah, you mean you bring your own foreign VPS/IP and use that as input for geoip-shell for testing the connection. Well, if we get a bunch of those VPS's running we could share those sites...? Donating a some €'s or $'s for this would be no problem for our company.

Also, not sure if ping/icmp will work 100% of the time. A lot of servers are behind a rudimentary, hosted firewall that block pings before they ever reach your VPS (we could solve this by doing a GET or HEAD on /up or /health-endpoint that simple throws a 200 OK).

geoip-shell was exactly what I was looking for. Saw a lot of snippets that promised to do the same, but didn't deliver.
If you compare it to Cloudflare's country/geo filter: it does the same thing (but with lots of added complexity, vendor lock in and money). So, don't be to modest about this project!