Geoblock Registration 1.2.2

[Sim]

Sim updated Geoblock Registration with a new update entry:

1.2.2 bugfix - assert admin permission

• Minor bugfix to explicitly enforce admin permissions on admincp tools
• updated icon
• latest composer dependencies

Read the rest of this update entry...

 

[Black Tiger]

Hello.
I encountered an odd issue today. Got a moderation warning about a user, which wondered me.


So it says "ip country was neither allowed nor denied" which means "not present". However this is in my blocking list:
AL, AM, AR, AZ, BA, BG, BR, BY, CA, CN, DZ, EE, EG, etc.

Brazil is BR.
Then I checked the IP:

Hostname: 181.215.16.38
ASN: 61317
ISP:IPXO
Services: Datacenter
Country: Brazil

So did I do something wrong or why was this not recognized as Brazil?

P.s. I didn't bother to mask ip or mail address since it's a spammer anyway.

 

[Sim]

Hello.
I encountered an odd issue today. Got a moderation warning about a user, which wondered me.
View attachment 318486

So it says "ip country was neither allowed nor denied" which means "not present". However this is in my blocking list:
AL, AM, AR, AZ, BA, BG, BR, BY, CA, CN, DZ, EE, EG, etc.

Brazil is BR.
Then I checked the IP:

So did I do something wrong or why was this not recognized as Brazil?

P.s. I didn't bother to mask ip or mail address since it's a spammer anyway.

This is a case where the IP address has likely recently been re-assigned to a new provider and so GeoIP databases haven't been updated yet.

We're using Maxmind's database, which believes the IP address in question is used by a business in the UAE - which is why it doesn't detect it as Brazil or any other country in your block list.

GeoIP web services demo | MaxMind

Demo MaxMind’s GeoIP web services by entering up to 25 IP addresses. Instantly access IP geolocation data from our most accurate API solution.

www.maxmind.com

There is a "Submit a data correction" button on that page which it might be worth using to prompt Maxmind to update this address.

It's rare that this happens - but IP address blocks do get reassigned fairly regularly, so it is quite likely to happen at some point.

 

[Alvin63]

Does this still work if you use Cloudflare please?

 

[Sim]

Does this still work if you use Cloudflare please?

Yes, I use Cloudflare and it works.

You do need to make sure that your web server is passing on the real IP address to XF and not just the Cloudflare IP addresses - XF should do that automatically, but you can also configure that at the web server level.

 

[Alvin63]

Thank you. Yes I'll have to check that.

 

[Alvin63]

Yes, I use Cloudflare and it works.

You do need to make sure that your web server is passing on the real IP address to XF and not just the Cloudflare IP addresses - XF should do that automatically, but you can also configure that at the web server level.

Following on from this - where would I check that please? Within Cloudflare or within Xenforo?

Also I'm not quite clear about the Maxmind integration. Is there a need to create an account there, obtain a key and then enter it in your addon?

 

[Sim]

Following on from this - where would I check that please? Within Cloudflare or within Xenforo?

Also I'm not quite clear about the Maxmind integration. Is there a need to create an account there, obtain a key and then enter it in your addon?

Have a look in XenForo at the current visitors to your site - look at the IP addresses being reported - if they are not cloudflare addresses, then you're good. If everyone is from cloudflare - further configuration is required.

Yes you'll require a Maxmind account to use the Geoblock registration functionality - the addon automatically downloads the latest database from Maxmind via cron task, which requires an account.

Register for an account and obtain a license key to download GeoLite2 databases:

GeoLite2 Sign Up | MaxMind

 

[Alvin63]

This might sound dumb but how can I tell if they're Cloudflare addresses? I can see some IP's next to guests and it just gives an IP address when clicked on. Although a google one says ip address googlebot.com.

Also when registering for Maxmind there;s an option to opt out for "Please do not sell data associated with my IP address". Assume that's a good idea to opt for? I've done the limited opt-out.

 

[Sim]

See: https://www.cloudflare.com/en-au/ips/

 

[Alvin63]

Ok so IP's between 100 and 198 are cloudflare IP's is that right? I have "guests" viewing at the moment - most seem to be in that range, except google bot which is 66. So assume those are Cloudflare IP's then?

 

[Sim]

Ok so IP's between 100 and 198 are cloudflare IP's is that right?

Not exactly - those are IP ranges, not every address starting with 103 is a Cloudflare address.

You need to use an IPv4 calculator to tell you exactly which addresses are in the range - for example:

Subnet Calculator - CIDR - IP ADDRESS CALCULATOR - MxToolbox

mxtoolbox.com

Enter 103.21.244.0/22 (from the Cloudflare page I linked to) and his calculate, it will tell you that the CIDR IP Range is: 103.21.244.0 - 103.21.247.255 ... meaning that if you have someone visiting using an address between those two addresses, it's coming from Cloudflare and is not their real IP. You then need to do that with all of the other ranges.

However, it's probably easier to just copy and paste the IP addresses you actually have into a site like:

https://whatismyipaddress.com/

... indeed if you just add the IP address to the end of the URL as such: https://whatismyipaddress.com/ip/49.237.40.74 ... it will tell you where that address is located and who controls it.