topic Re: Geopolicy blocks 8.8.8.8 (India) in General Topics

Geopolicy blocks 8.8.8.8 (India)

ED — Thu, 13 Aug 2020 07:05:01 GMT

Hi everyone,

If you have geo policy enabled and blocking to and from India your DNS request for Google 8.8.8.8 will be blocked.

Checking IP 8.8.8.8 now shows India.

Anyone else seeing this?

Re: Geopolicy blocks 8.8.8.8 (India)

_Val_ — Thu, 13 Aug 2020 07:18:50 GMT

Please go to https://ipstack.com/ and show output you have for 8.8.8.8

Re: Geopolicy blocks 8.8.8.8 (India)

ED — Thu, 13 Aug 2020 07:20:51 GMT

The output shows US but I believe Check Point is using Maxmind?

Maxmind shows India.

You can check yourself https://www.maxmind.com/en/geoip-demo

Thanks for the quick reply.

Re: Geopolicy blocks 8.8.8.8 (India)

_Val_ — Thu, 13 Aug 2020 07:26:03 GMT

You are correct, it does how India. I would suggest TAC case, if you believe this info is incorrect. You can also send a correction directly to the service via the online form.Not sure, how effective that would be.

Re: Geopolicy blocks 8.8.8.8 (India)

Timothy_Hall — Thu, 13 Aug 2020 13:59:05 GMT

Running a traceroute to 8.8.8.8 from the USA and looking at the hops leading up to the final 8.8.8.8 destination and the relatively low latencies at each hop (15 ms or less), my opinion is the India classification for that address is not correct.

Also when blocking countries with Geo Policy it is usually a good idea to create an exception for all domain-udp and domain-tcp traffic to avoid what I call "Indirect DNS blocks" in my book, which can cause seemingly random failures accessing certain sites whose server location and/or DNS service happen to load-balance into a blocked country.

Re: Geopolicy blocks 8.8.8.8 (India)

Steve_Spohn — Thu, 13 Aug 2020 13:14:25 GMT

I saw the same behavior this morning w/ 8.8.8.8 being classified in India. Thanks for the best practice suggestion, makes sense to me, was an easy fix!

Re: Geopolicy blocks 8.8.8.8 (India)

HristoGrigorov — Fri, 14 Aug 2020 04:01:50 GMT

I went hardcore and blocked some countries using fwaccel dos rate command 😀 As I am using upstream DNS as forwarder, that seems to take care of the problem with accessing sites, etc.

Re: Geopolicy blocks 8.8.8.8 (India)

Tobias_Moritz — Fri, 14 Aug 2020 12:45:12 GMT

Well, locating the well known Google DNS server 8.8.8.8 in India is right and wrong at the same time.

Google uses anycast routing to give you the nearest operational server, depending on your source network.

See Wikipedia article about Google Public DNS.

Geolocation databases cannot show the right info here, as these adresses cannot be assigned to a fixed location.