UI support for Geo IP management in Threat Shield IP

[cotosso]

Description
Add UI support for Geo IP management in the Threat Shield IP section.

The new UI must allow administrators to block traffic by geographic area, including both:

• full continent blocking
• granular exceptions within a blocked continent

Example:

• block all Europe
• allow specific countries such as Italy and the UK

The list of supported countries/states must be based on the entries available in the banip.countries list:
https://github.com/openwrt/packages/blob/master/net/banip/files/banip.countries

Since that list also contains some grouped entries that are not usable as-is, the UI and logic should reorganize the available items according to geographic concepts by comparing the current list with the regional classification provided here:
https://github.com/lukes/ISO-3166-Countries-with-Regional-Codes/blob/master/all/all.csv

This feature is needed to make Geo IP filtering easier to configure from the UI and to provide a clearer and more flexible user experience for geographic blocking rules.

It should also include a UI PR for the frontend implementation.

Proposed solution
Implement a new Geo_IP tab inside Threat Shield IP.

The new tab should:

• provide a UI to enable/disable the Geo IP blocking service
• allow selection of whole continents
• allow per-country exceptions and overrides inside selected continents
• support configurations such as “block Europe except Italy and UK”
• use the country list from banip.countries
• reorganize countries into meaningful geographic groupings by mapping them against the ISO 3166 regional dataset

Additionally:

• remove the existing “country block” toggle currently available among the blacklists
• move that toggle into the new Geo_IP tab
• use it as the main global switch for the Geo IP service

The implementation should be delivered with a dedicated PR for the UI side.

See also

• https://github.com/openwrt/packages/blob/master/net/banip/files/banip.countries
• https://github.com/lukes/ISO-3166-Countries-with-Regional-Codes/blob/master/all/all.csv

Components
NethSecurity 8.7.2

[m-dilorenzi]

QA

Image: image

Threat Shield IP disabled

1. Log in to NethSecurity.
2. Go to Security > Threat Shield IP.
3. Verify in the Settings tab that the service is disabled.
4. Go to the Geoblocking tab and verify that the following message appears:

5. Enable the Threat Shield IP service from the Settings menu and verify that the toggle to enable Geo IP blocking is correctly visible in the Geoblocking tab.

Enabling Geo IP blocking

1. Log in to NethSecurity.
2. Go to Security > Threat Shield IP.
3. Go to the Geoblocking tab.
4. Enable the Geo IP blocking toggle.
5. Verify that the following section appears:

Selecting countries

1. Log in to NethSecurity.
2. Go to Security > Threat Shield IP.
3. Go to the Geoblocking tab.
4. Enable the Geo IP blocking toggle.
5. Select one or more countries from the regions menu.
6. Verify that each selected country shows the Blocked badge and that the region panel displays the correct number of blocked countries.

(1 blocked country)

(2 blocked countries)

7. Verify that the status filter, the Block/Allow all buttons, and the text input work correctly.

8. Save the configuration and check that the service status and the number of blocked countries are correct, and that unsaved changes are shown at the top of the screen.

9. Commit the changes and verify that the page reloads correctly.

Disable Geo IP blocking

1. Log in to NethSecurity.
2. Go to Security > Threat Shield IP.
3. Go to the Geoblocking tab.
4. Disable the Geo IP blocking toggle with one or more countries selected.
5. Save the configuration and commit the changes.
6. Re-enable the Geo IP blocking service and check that the previously selected countries are correctly visible again.
7. Save the configuration, commit the changes, and verify that the page reloads correctly.

NFT ruleset

Each addition or removal of a country from the set of blocked countries updates the banIP table managed by nft.

To verify that the feature works correctly, you can also inspect the related nft table using the following command:

nft list table inet banIP

Then check the two entries countryv4 and countryv6.

[cotosso]

Everything work as expected.