bmatthewshea · August 16, 2025 01:19 · FoulFoot · Feb 15, 2024 · FoulFoot · Feb 15, 2024
diff --git a/- postfix-geoip.pl b/- postfix-geoip.pl
 #!/usr/bin/perl
 # Brady Shea Feb 25 2019
 # starting point: 
 # http://web.archive.org/web/20151128083440/https://www.kutukupret.com/2011/05/29/postfix-geoip-based-rejections/
 use strict;
 use warnings;
 use Sys::Syslog qw(:DEFAULT setlogsock);
 use Geo::IP;
 use Regexp::Common;

 #my $gi = Geo::IP->new(GEOIP_INDEX_CACHE);  #should probably use this one? works. New spawns after 3600s, though.
 my $gi           = Geo::IP->new(GEOIP_STANDARD);
 my $country_code = "";
 my $client       = "";

 # Country codes to reject
 my @geo_map = (
    'BR' ,
    'PW' ,
    'NL' ,
    'JP' ,
    'UA' ,
    'LR' ,
    'KR' ,
    'RO' ,
    'IN' ,
    'CN' ,
    'HK' ,
    'TW' ,
    'RU'
 );

 #
 # Initalize and open syslog.
 #
 openlog('postfix/geoip','pid','mail');

 #
 # Autoflush standard output.
 #
 select STDOUT; $|++;

 while (<>) {
  if ($_ =~ /\w\s\w/)  # if two words..
  {
    chomp;

    $_ =~ s/^\S+\s*//; #Remove "get " (first word)
    $client    = $_;

    #check tld sent first to avoid geoip call if possible (example mailer.domain.ru = .ru/RU)
    $country_code = uc tld_check($client);
    if ( grep /$country_code/, @geo_map )
    {
      reject_country();
      $country_code="";  # remove
      next;
    }
    #geoip tests
    if ( $client =~ m/$RE{net}{IPv4}/ ){
      $country_code = $gi->country_code_by_addr($client); # is IP - normally NOT sent by POSTFIX "check_client_access tcp:" - sends 'unknown'
    } else {
      $country_code = $gi->country_code_by_name($client); # is DNS name
    }

    if (defined $country_code)
    {
      if ( grep /$country_code/, @geo_map )
        {
           reject_country();
           } else {
           approve_country();
           }
        } else {
          unknown_country();
        }
        next;
  }
  #incomplete lookup (was the "get sub.domain.tld" missing the 'get'? The string is always 2 parts.
  lookup_error();
 }

 # SUBS

 #quick check on TLD to see if it matches our banned tlds. This should avoid calling GEOIP too much
 sub tld_check {
  my @pieces = split /\./,$_;
  my $tld   = $pieces[-1];
  chomp($tld);
  return $tld;
 }
 sub reject_country {
  print "200 REJECT no connections accepted from country code $country_code\n";
  syslog("info","Client: %s REJECTED because of country code match %s", $client, $country_code);
  return
 }
 sub approve_country {
  print "200 DUNNO passed geoip check\n";
  syslog("info","Client: %s PASSED geoip from country code: %s", $client, $country_code);
  return
 }
 sub unknown_country {
  print "200 DUNNO geoip country not found\n";
  syslog("info","Client: %s PASSED geoip - no country found", $client);
  return
 }
 # This next one should probably be switched to REJECT if I start seeing many of them.
 # POSTFIX should ALWAYS send a two part string.
 sub lookup_error {
  print "200 DUNNO geoip skipped\n";
  syslog("info","Incomplete DATA received from MTA to do a geoip check");
  return;
 }
diff --git a/README-postfix-geoip.md b/README-postfix-geoip.md
	#!/usr/bin/perl
	# Brady Shea Feb 25 2019
	# starting point:
	# http://web.archive.org/web/20151128083440/https://www.kutukupret.com/2011/05/29/postfix-geoip-based-rejections/
	use strict;
	use warnings;
	use Sys::Syslog qw(:DEFAULT setlogsock);
	use Geo::IP;
	use Regexp::Common;

	#my $gi = Geo::IP->new(GEOIP_INDEX_CACHE); #should probably use this one? works. New spawns after 3600s, though.
	my $gi = Geo::IP->new(GEOIP_STANDARD);
	my $country_code = "";
	my $client = "";

	# Country codes to reject
	my @geo_map = (
	'BR' ,
	'PW' ,
	'NL' ,
	'JP' ,
	'UA' ,
	'LR' ,
	'KR' ,
	'RO' ,
	'IN' ,
	'CN' ,
	'HK' ,
	'TW' ,
	'RU'
	);

	#
	# Initalize and open syslog.
	#
	openlog('postfix/geoip','pid','mail');

	#
	# Autoflush standard output.
	#
	select STDOUT; $\|++;

	while (<>) {
	if ($_ =~ /\w\s\w/) # if two words..
	{
	chomp;

	$_ =~ s/^\S+\s*//; #Remove "get " (first word)
	$client = $_;

	#check tld sent first to avoid geoip call if possible (example mailer.domain.ru = .ru/RU)
	$country_code = uc tld_check($client);
	if ( grep /$country_code/, @geo_map )
	{
	reject_country();
	$country_code=""; # remove
	next;
	}
	#geoip tests
	if ( $client =~ m/$RE{net}{IPv4}/ ){
	$country_code = $gi->country_code_by_addr($client); # is IP - normally NOT sent by POSTFIX "check_client_access tcp:" - sends 'unknown'
	} else {
	$country_code = $gi->country_code_by_name($client); # is DNS name
	}

	if (defined $country_code)
	{
	if ( grep /$country_code/, @geo_map )
	{
	reject_country();
	} else {
	approve_country();
	}
	} else {
	unknown_country();
	}
	next;
	}
	#incomplete lookup (was the "get sub.domain.tld" missing the 'get'? The string is always 2 parts.
	lookup_error();
	}

	# SUBS

	#quick check on TLD to see if it matches our banned tlds. This should avoid calling GEOIP too much
	sub tld_check {
	my @pieces = split /\./,$_;
	my $tld = $pieces[-1];
	chomp($tld);
	return $tld;
	}
	sub reject_country {
	print "200 REJECT no connections accepted from country code $country_code\n";
	syslog("info","Client: %s REJECTED because of country code match %s", $client, $country_code);
	return
	}
	sub approve_country {
	print "200 DUNNO passed geoip check\n";
	syslog("info","Client: %s PASSED geoip from country code: %s", $client, $country_code);
	return
	}
	sub unknown_country {
	print "200 DUNNO geoip country not found\n";
	syslog("info","Client: %s PASSED geoip - no country found", $client);
	return
	}
	# This next one should probably be switched to REJECT if I start seeing many of them.
	# POSTFIX should ALWAYS send a two part string.
	sub lookup_error {
	print "200 DUNNO geoip skipped\n";
	syslog("info","Incomplete DATA received from MTA to do a geoip check");
	return;
	}