Block a whole country with a Cisco ASA

Block a whole country with a Cisco ASA

Thanks to some good pointers from Vibhor Amrodia here, I was able to rewrite my Linux Netfilter countryblock script to create object-groups for Cisco ASA firewalls which can easily be used in access-lists. This example loads the IP-ranges of China, Korea and Palestine from and creates a config file. This config file can easily be copied from a TFTP server to the running config of the ASA. I chose those 3 countries because the vast majority of probes, scans and SIP fraud attempts on my network come from there.

NOTE: has recently been a bit lame with updating their lists but they are still a good source - not alone because their lists are easy to parse in scripts.

Disclaimer: This script comes with no guarantee nor support! I don’t assume any kind of liability! If you don’t know what you are doing, you shouldn’t build a firewall yourself.


WORKDIR="/storage/tftp"               # Put your TFTP directory here

function cdr2mask
     # Number of args to shift, 255..255, first non-255 byte, zeroes
     set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0
     [ $1 -gt 1 ] && shift $1 || shift
     echo ${1-0}.${2-0}.${3-0}.${4-0}

if ! test -d ${BLOCKDIR}; then
     mkdir ${BLOCKDIR}


echo "Country blocking rules..."
echo "Downloading rules..."

curl -s -o ${BLOCKDIR}/ 
     || echo "Warning: Couldn't download CN zone"

curl -s -o ${BLOCKDIR}/ 
     || echo "Warning: Couldn't download KR zone"

curl -s -o ${BLOCKDIR}/ 
     || echo "Warning: Couldn't download PS zone"

echo "Done downloading."

echo "! Country objects - $(date)" > ${BLOCKFILE}

for FILE in ${BLOCKDIR}/*.zone; do

     CODE=$(basename ${FILE} | cut -d. -f1 | tr [:lower:] [:upper:])

     echo "! --- ${CODE} ---------------------------------------------------------------" >> ${BLOCKFILE}
     echo "no object-group network block-${CODE}" >> ${BLOCKFILE}
     echo "object-group network block-${CODE}" >> ${BLOCKFILE}
     for ADDRESS in $(cat ${FILE}); do
          ADR=$(echo ${ADDRESS} | cut -d/ -f1)
          SUN=$(echo ${ADDRESS} | cut -d/ -f2)
          MSK=$(cdr2mask ${SUN})
          echo -n "."
          echo "network-object ${ADR} ${MSK}" >> ${BLOCKFILE}
     echo ""

echo "Done. Started: ${DATE}, finished: $(date)"