Geopolicy blocks 8.8.8.8 (India)

[ED]

Hi everyone,

If you have geo policy enabled and blocking to and from India your DNS request for Google 8.8.8.8 will be blocked. 

Checking IP 8.8.8.8 now shows India.

Anyone else seeing this?

[_Val_]

Please go to https://ipstack.com/ and show output you have for 8.8.8.8

[ED]

The output shows US but I believe Check Point is using Maxmind? 

Maxmind shows India.

You can check yourself https://www.maxmind.com/en/geoip-demo

Thanks for the quick reply.

[_Val_]

You are correct, it does how India. I would suggest TAC case, if you believe this info is incorrect. You can also send a correction directly to the service via the online form.Not sure, how effective that would be.

[Timothy_Hall]

Running a traceroute to 8.8.8.8 from the USA and looking at the hops leading up to the final 8.8.8.8 destination and the relatively low latencies at each hop (15 ms or less), my opinion is the India classification for that address is not correct.

Also when blocking countries with Geo Policy it is usually a good idea to create an exception for all domain-udp and domain-tcp traffic to avoid what I call "Indirect DNS blocks" in my book, which can cause seemingly random failures accessing certain sites whose server location and/or DNS service happen to load-balance into a blocked country.

[Steve_Spohn]

I saw the same behavior this morning w/ 8.8.8.8 being classified in India. Thanks for the best practice suggestion, makes sense to me, was an easy fix!

[HristoGrigorov]

I went hardcore and blocked some countries using fwaccel dos rate command 😀 As I am using upstream DNS as forwarder, that seems to take care of the problem with accessing sites, etc.

[Tobias_Moritz]

Well, locating the well known Google DNS server 8.8.8.8 in India is right and wrong at the same time.

Google uses anycast routing to give you the nearest operational server, depending on your source network.

See Wikipedia article about Google Public DNS.

Geolocation databases cannot show the right info here, as these adresses cannot be assigned to a fixed location.