How to locate the IP address range mapping to country/Region

[AdrianBuck1]

Where can you locate the IP address ranges for the Country/Regions.  I am adding in a block rule for specific regions, but I need to know the IP address ranges that this uses in order for uses with some identity blocking.

[rmfalconer]

I'm not sure you can view the full list of IP to country mapping.

You can query an address and get the mapped location:

fw> show location ip 8.8.8.8

8.8.8.8
United States

You can use a directory like Nirsoft to view the geoblocks then run the CLI to verify the PA has associated it to the expected country.

https://www.nirsoft.net/countryip/

[BPry]

@AdrianBuck1,

GeoIP databases are generally paid services. The free services that you'll find are usually only looking at registry data and won't be as accurate as  paid services like IP2Location or MaxMind. If I were you, I would use MaxMind's free Geo2Lite if you were looking for a free option to get as accurate as possible.

If you're willing to spend a bit of money, MaxMind and IP2Location will sell you their database access for a minimal one-time fee. I think IP2Location is like $50 and MaxMind's one-time cost like $25 or there about. That provides as accurate data as you can get that are utilized across the industry. 

[rmfalconer]

IP blocks were allocated to regional registries which then allocate them to local providers. The assigned blocks are not contiguous. Australia is in the APNIC region so they would be allocated from APNIC controlled address space. 

[Adrian_Jensen]

Ummm... "Lakin985" appears to be a new bot account to post spam... The "reply" is a direct copy of a StackOverflow post 9 years ago. I'm betting in the next day or two the account will edit the post to include a spam link in the quoted content.

[Fagani]

I want to block all countries except my own country. How to do it in a simple and short way?

[BPry]

@Fagani,

Only specify your own country in any exposed security rulebase rules that you have, or alternatively only allow access to external resources within your own country if you wish to block access to things hosted externally as well. 

You could do this for every entry that you create in your rulebase, or you could alternatively make a "blocklist" sort of entry at the very top of your rulebase. Set everything from untrust or whatever you call your external security zone, and then simply negate your country from the rule. This will drop everything cleanly under one rule entry.