Geolocation access denied - but in Germany

[dancgn]

1. The problem I’m having:

I try to get geoblocking working

2. Error messages and/or full log output:

Access denied

3. Caddy version:

v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=

4. How I installed and ran Caddy:

bare metal on a raspberry 4 with DietpiOS

a. System environment:

DietpiOS 9.8.0 ARM64 Raspberry

c. Service/unit/compose file:

(mygeofilter) {
    @mygeofilter {
        maxmind_geolocation {
            allow_countries DE
            db_path /usr/share/GeoIP/GeoLite2-Country.mmdb
        }
    }

    respond @mygeofilter "Access Denied" 403
}
my.example.de {
    import cloudflare
    import secure-headers
    import mygeofilter
    encode gzip
    reverse_proxy 192.168.0.0:12345 {
        transport http {
            tls_insecure_skip_verify
        }
    }
    log {
        output file /var/log/caddy/dsm.access.log
        format json
    }
}

The plugin is installed and working. Want to “ban” all countries without germany (DE). But I’m in Germany and I didn’t got access.
Second try is only to deny_countries like RU UNK CH, but that working either.

Thanks for help

[Bruce5051 (Bruce)]

@dancgn

try is only to deny_countries like RU UNK CH, but that working either

Hi @dancgn,

Since that quoted above is working, but not working

@dancgn

to “ban” all countries without germany (DE)

You might need to check the integrity of the database, making sure DE is in it properly.

[dancgn]

Of course it’s not working either. Sorry…

Check the integrity of the db? Peh, I don’t know how?!? Just downloaded from Maxmind and set a cron to update the file daily. DE seems the right code for Germany.

[stbu (Steffen)]

Try to enable debug in global options and check log output. The maxmind matcher has debug logging statements, so this could reveal the issue.

[dancgn]

Okay, in the journal this is the only with geolocation

Dez 10 18:42:48 caddy caddy[2430921]: {"level":"debug","ts":1733852568.3902059,"logger":"http.matchers.maxmind_geolocation","msg":"Detected MaxMind data","ip":"84.44.197.76","country":"DE","subdivisions":"","metro_code":0,"asn":0}

[stbu (Steffen)]

So the matcher will return true if the subsequent debug logs are not appearing like „Country not allowed“

porech/caddy-maxmind-geolocation/blob/c7dd9b5c8231800f7cd959d195e19d3d32bb38c3/main.go#L270

And 84.44.197.76 is your IP and you still get the 403, right?

Have a look on the example on the GitHub - porech/caddy-maxmind-geolocation: Caddy v2 module to filter requests based on source IP geolocation where the matcher is used for something positive like access to the file_server.

Your example is saying that a matching request (from country germany) should get the 403.

Try not in front of maxmind_geolocation or apply the matcher to the reverse proxy, but be aware of the directive ordering in caddyfile as respond comes before reverse proxy. A route would help for that.

[dancgn]

Ah, now I understand! And it works with a “no” in front of maxmind_geolocation.
Of course, as I read you’re post I realize my mistake. ChatGPT helps me, but this mistake I didn’t “see”.

Thanks!