Questions[geoip](server)

I have a nginx/1.10.1 on my CentOS 7 installed via nginx repo. I just install geoip module

[root@www nginx]# nginx -V
nginx version: nginx/1.10.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic **--with-http_geoip_module=dynamic** --with-http_perl_module=dynamic --add-dynamic-module=njs-1c50334fbea6/nginx --with-threads --with-stream --with-stream_ssl_module --with-http_slice_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_v2_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic'

Added geoip_country GeoIP.dat; to http section on nginx.conf, but when I am doung configtest

[root@www nginx]# nginx -t
nginx: [emerg] unknown directive "geoip_country" in /etc/nginx/nginx.conf:40
nginx: configuration file /etc/nginx/nginx.conf test failed

Can anybody help me? Thanks beforehand.

apache httpd.conf

LoadModule geoip_module modules/mod_geoip.so
<IfModule mod_geoip.c>
    GeoIPEnable On
    GeoIPEnableUTF8 On
    GeoIPOutput Env
    GeoIPScanProxyHeaders On
    GeoIPDBFile /usr/share/GeoIP/GeoIP.dat IndexCache
</IfModule>

HTTP Request:

GET /test.php HTTP/1.1
Host: XXXXXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
X-Forwarded-For: 150.XX.XX.XXX

test page /test.php

<?php

if( isset($_SERVER['GEOIP_COUNTRY_CODE']) ){
    echo 'GEOIP_COUNTRY_CODE: '.$_SERVER['GEOIP_COUNTRY_CODE'].'<br>';
}

if( isset($_SERVER['GEOIP_COUNTRY_NAME']) ){
    echo 'GEOIP_COUNTRY_NAME: '.$_SERVER['GEOIP_COUNTRY_NAME'].'<br>';
}

if( isset($_SERVER['GEOIP_ADDR']) ){
    echo 'GEOIP_ADDR: '.$_SERVER['GEOIP_ADDR'].'<br>';
}

if( isset($_SERVER['HTTP_X_FORWARDED_FOR']) ){
    echo 'HTTP_X_FORWARDED_FOR: '.$_SERVER['HTTP_X_FORWARDED_FOR'].'<br>';
}

echo 'REMOTE_ADDR: '.$_SERVER['REMOTE_ADDR'].'<br>';

Output

GEOIP_COUNTRY_CODE: IT
GEOIP_COUNTRY_NAME: Italy
GEOIP_ADDR: 66.XX.XX.XXX
HTTP_X_FORWARDED_FOR: 150.XX.XX.XXX
REMOTE_ADDR: 66.XX.XX.XXX

expected

GEOIP_COUNTRY_CODE: US
GEOIP_COUNTRY_NAME: United States
GEOIP_ADDR: 150.XX.XX.XXX
HTTP_X_FORWARDED_FOR: 150.XX.XX.XXX
REMOTE_ADDR: 66.XX.XX.XXX

mod_geoip seems to not use HTTP_X_FORWARDED_FOR ipaddress... why?

Server version: Apache/2.4.18 (Unix) Server built:   Feb  4 2016 17:41:16
Loaded Modules:
 core_module (static)
 so_module (static)
 http_module (static)
 authn_file_module (shared)
 authn_core_module (shared)
 authz_host_module (shared)
 authz_groupfile_module (shared)
 authz_user_module (shared)
 authz_core_module (shared)
 access_compat_module (shared)
 auth_basic_module (shared)
 socache_shmcb_module (shared)
 reqtimeout_module (shared)
 filter_module (shared)
 substitute_module (shared)
 deflate_module (shared)
 mime_module (shared)
 log_config_module (shared)
 env_module (shared)
 expires_module (shared)
 headers_module (shared)
 setenvif_module (shared)
 version_module (shared)
 proxy_module (shared)
 proxy_connect_module (shared)
 proxy_ftp_module (shared)
 proxy_http_module (shared)
 proxy_fcgi_module (shared)
 proxy_scgi_module (shared)
 proxy_wstunnel_module (shared)
 proxy_ajp_module (shared)
 proxy_balancer_module (shared)
 proxy_express_module (shared)
 slotmem_shm_module (shared)
 lbmethod_byrequests_module (shared)
 lbmethod_bytraffic_module (shared)
 lbmethod_bybusyness_module (shared)
 lbmethod_heartbeat_module (shared)
 mpm_event_module (shared)
 unixd_module (shared)
 status_module (shared)
 autoindex_module (shared)
 negotiation_module (shared)
 dir_module (shared)
 actions_module (shared)
 alias_module (shared)
 rewrite_module (shared)
 geoip_module (shared)

I suspect that the version of my geoip is old

$ dpkg -l | grep apache

maybe it is

ii  libapache2-mod-geoip   1.2.8-2  amd64        
    GeoIP support for apache2

On CentOS 6 I cannot install GeoIP even though many websites describe installing GeoIP with the following commands:

yum install GeoIP GeoIP-devel GeoIP-data

I get No package GeoIP available.

Is there any firewall(preferred some free :) ) that can block all communication from all ip addresses except from some IP's coming from a particular location...

i basically want to block DDOS attack on my servers its being getting hit from some IP's outside my country

EDIT: i am using 1 window machine and 1 linux machine

EDIT 2: I have heard of some organization running in INDIA that helps us in doing this thing, so i think it is possible. They filter only the IP's coming from india region only and blocks the rest.

I have a website that needs to block a particular country based on IP address. I am more than aware that IP-based blocking is not a foolproof method for blocking visitors, but it is a necessary step in the right direction.

Since I'm using PHP, what I would do is use a GeoIP database like geoplugin.net. However, I'm curious to know if there's a better way of doing this.

The website is on a shared webserver (I don't have root access) and it is running Apache on centOS. I guess my question is "can an .htaccess file be configured to block by IP using an external source to lookup IP addresses."