GeoIP Filtering and Asterisk

What is GeoIP Filtering?

GeoIP filtering allows you to control access to your Asterisk VoIP system based on the geographical location of incoming connections. This helps prevent unauthorized access and reduces the risk of toll fraud from high-risk countries.

• Block entire countries or regions from accessing your PBX
• Reduce toll fraud and unauthorized international calls
• Implement time-based geographical restrictions
• Create custom routing rules based on caller location

Implementation Guide

1. Install GeoIP Database: Download and install MaxMind GeoIP database for IP geolocation data.
2. Configure Asterisk: Modify Asterisk dialplan and SIP configuration to integrate GeoIP lookups.
3. Set Filtering Rules: Define country-based allow/deny rules and custom actions.

Configuration Examples

Basic Country Blocking

; Block specific countries in extensions.conf
exten => _X.,1,GotoIf($["${GEOIP_COUNTRY}"="CN"]?blocked)
exten => _X.,n,GotoIf($["${GEOIP_COUNTRY}"="RU"]?blocked)
exten => _X.,n,Dial(SIP/${EXTEN})
exten => _X.,n(blocked),Hangup()

Whitelist Configuration

; Allow only specific countries
exten => _X.,1,GotoIf($["${GEOIP_COUNTRY}"="GB"]?allowed)
exten => _X.,n,GotoIf($["${GEOIP_COUNTRY}"="US"]?allowed)
exten => _X.,n,Hangup()
exten => _X.,n(allowed),Dial(SIP/${EXTEN})

Time-Based Restrictions

; Different rules for business hours
exten => _X.,1,GotoIf($[${HOUR}>8 & ${HOUR}<17]?business:after)
exten => _X.,n(business),GotoIf($["${GEOIP_COUNTRY}"!="GB"]?blocked)
exten => _X.,n(after),GotoIf($["${GEOIP_CONTINENT}"!="EU"]?blocked)

Best Practices

• Regularly update GeoIP databases for accuracy
• Implement fail2ban alongside GeoIP filtering
• Log blocked attempts for security analysis
• Use VPN exceptions for legitimate remote users
• Combine with strong SIP authentication
• Cache GeoIP lookups to reduce latency