In my previous post I have showed how to easily generate IP range assigned to some country. I have modified this previous script to generate IP blocks for all countries and put it online for free download and usage.
You can find them here http://www.iwik.org/ipcountry/ This list is generated daily at 12:00 CET.
This list can be used for example on mikrotik router to block/allow access from specified countries.
To import country range, for example Slovak ranges, as firewall address-list use commands
/tool fetch url=http://www.iwik.org/ipcountry/mikrotik/SK
/import file-name=SK
UPDATE:
IPv6 is now supported and script also generates IPv6 firewall address list. See http://blog.erben.sk/2019/12/11/country-ipv6-ranges/
UPDATE 2:
I have found, it can be usefull also for HAProxy http://blog.erben.sk/2020/12/02/haproxy-country-filtering-acl/
Hi, it was just problem with php after upgrade. Solved.
Hi, I love your script and service for Country CIDR IP’s on Mikrotik devices and have just returned to it after not using it for a year or two because of a little quirk that was creating me an issue. but with ROS 7.1 my vastly more inefficient method has become a headache for me.
However the reason I stopped using your script is because it loads the address lists into system flash or disk. This can cause them to be slower and on smaller systems like the HeX S with limited Flash, it can fill the flash crashing the box.
I have found this can be fixed though by making the subtle change of adding a time out to the address list entry (which I currently do manually):
:do { add address=0.0.0.0/24 list=XX timeout=60d } on-error={}
Adding the timeout makes the list a dynamic list and loads it into RAM, making for faster lookups and load times. The downside is that it expires out after 60 days and disappears on reboot. However being that Geo IP’s should be refreshed every 30 days, I just run your script on on boot (with a 30 second delay) and on a 30 day schedule.
Right now I have to download your IP lists manually and modify them in a txt editor before loading them onto the router (which is tedious). I was just wondering your thoughts on this, maybe your advice, or even get you to consider a change to your code (consider, not expect)?
any way to get list by continent?
thanks
Could you please add 82.214.102.0/24 to HR country IP list? It belong to AKTON d.o.o. ISP
Hi, in RIPE range 82.214.64.0/18 is assigned to Slovenia.
great stuff. I wonder if you can also add a list for AWS / Azure / Google Cloud IPs ?
Thanks!
Are those list updated? For example “iCloud egress” ip ranges (for people using iCloud Private Relay) are not included for Italy
https://mask-api.icloud.com/egress-ip-ranges.csv
or… 37.160.1.1 is incorrectly assigned to France, but it’s currently in Italy for Iliad mobile operator.
Hello!!
There is a range in spain that is not present in the list…
79.116.0.0/15
Can you update the ES list?
Thank you
Hello from Kazakhstan, help me to add net to your range KZ
https://apps.db.ripe.net/db-web-ui/query?from=www&searchtext=176.120.72.147
Hi Greg, you can use this script to have timeout https://iwik.org/ipcountry/mikrotik_timeout.php?country=SK&timeout=60d
RIPE have this range assigned to MD.cidr:176.120.72.0/22
Hello,
Fetching list with http://www.iwik.org/ipcountry/mikrotik6/ does not work anymore (404 – not found).
Is it a glitch, or do I have to search for a new soluton?
BR,
Ivo
You don’t need use mikrotik6 link, use just https://www.iwik.org/ipcountry/mikrotik/SK, this should work also for RouterOS 6.x. I have split ipv6 into separate script, so if you need ipv6 then use https://www.iwik.org/ipcountry/mikrotik_ipv6/SK