WIPmania blog posts (English)

Nginx and Opera's proxies

Alex(WIPmania team) — Sun, 10 Apr 2011 00:00:00 -0500

Opera browser users are able to go online through a special proxy server of the Opera. Also, Opera Mini mobile customers use these servers.

Of course, IP addresses belong to these servers, but they send header "X-Forwarded-For" with the real IP address of the user.

The list of Opera's proxies is helpful to determine the real country.

Opera runs data centers in Norway, Iceland, Poland, USA and China.

Include file of proxies, then nginx automatically takes the real IP address, to determine the real country of the visitor.

You can download always actual database of Opera's proxies here:
http://wipmania.com/static/worldip.opera.conf

Use in nginx:


geo $country {
 default XX;
 include /etc/nginx/conf/worldip.opera.conf;
 include /etc/nginx/conf/worldip.conf;
}

(Article)

XX and routers in API

Nelli(WIPmania team) — Thu, 10 Feb 2011 00:00:00 -0600

XX is our code, the total value of which is "unknown". It includes:
- the empty or unallocated space,
- distributed, but unused networks,
- internal and test networks (10.0.0.0/8, 127.0.0.0/8, etc.),
- anycast (as an example - Google's DNS server 8.8.8.8),
- the recently announced, but not yet distributed on the internet networks.

There is no detailed information about the location of routers in API database, (we see it as unnecessary for "normal" user). Instead the region (e.g.: EU, AP) or the country of global operator (e.g.: CA for Tata) will be displayed. (Article)

Extended API

Nelli(WIPmania team) — Tue, 01 Feb 2011 00:00:00 -0600

We have made some changes on our website.
It is now possible to register your account.

If you are a registered user, you'll get a free daily statistic (distribution by time, countries and service codes) for your API-requests. It is important for detailed analysis of requests from different regions. For a small fee, you can also choose the nearest API server and use any other as a backup (useful for increasing the uptime of your system).

The exchange rates option is also interesting, for displaying prices of goods or services to your customers in their usual form, that increases your website's conversion rate.

In addition to currencies, also available are languages of the countries, provider, phone codes and other data. Read more on API. (News)

Unlimited API queries

Nelli(WIPmania team) — Fri, 17 Sep 2010 00:00:00 -0500

The limit of 10,000 API queries is canceled now. The daily number of queries and the number of queries per second are no more restricted. (News)

geoip for iptables

Alex(WIPmania team) — Fri, 05 Mar 2010 00:00:00 -0600

In firewall it is possible to filter by country. It is very useful to block certain countries or to balance the requests to different backends, each of which handles its region.

Now WorldIP database exists in the format for geoip module from the extension package xtables-addons for iptables. Using this module, you can build more flexible rules for iptables, based on IP-geolocation.

Installation of xtables-addons: The standard process of compilation and installation. Download the latest version (for iptables>= 1.4.3) and extract.
If you have an older version, e.g. in Lenny 1.4.2, and you do not want to update it, you should download xtables-addons v1.12.
xtables-addons contains many interesting modules, as e.g. TARPIT. You may choose any modules in the file "mconfig". "build_geoip = m" should remain in config file, than the geoip will be compiled.

Install the necessary dependencies (for debian-based):
```
aptitude -y install iptables-dev linux-headers-`uname -r`
```
Than
```
./configure --with-xtlibdir=/lib/xtables
make
make install
```
Check, if the installation is successful:
```
iptables -m geoip --help
```
Installation of the database for geoip
Already prepared database can be downloaded here. The database should be placed in /var/geoip (this is hardcoded in the source code). The database can be updated with cron (e.g. once a month), so that it remains actual.

Examples

Allow ssh for own country(DE) and the country where you take holidays(FR)

iptables -A INPUT -p tcp --dport 22 -m geoip --src-cc DE,FR -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

Block access to FTP server for Papua New Guinea (PG)

iptables -A INPUT -p tcp --dport 21 -m geoip --src-cc PG -j DROP
iptables -A INPUT -p tcp --dport 21 -j ACCEPT

Use separate marks for USA and the others, and send each type of traffic to its own destination

iptables -A INPUT -p tcp --dport 80 -m geoip --src-cc US -d <IP> -j MARK --set-mark 1
iptables -A INPUT -p tcp --dport 80 -m geoip ! --src-cc US -d <IP> -j MARK --set-mark 2

(Article)