Geofencing and Location Block, and LetsEncrypt

[jensse]

First thank you for a great firewall of software, that balance the “don’t make me think” with “Let me do what i need”. My current problem.

Situation:
I use LetsEncrypt on my webserver(s), when i want to update my certificates i need to turn off Location Block, due to the way LetsEncrypt validation infrastructure works. I do not want to run without LocationBlock, as this impose a significant rise in traffic and exposure from unwanted sources.

Current solution:

Every tree months, i disable Geo Location; Update certificates; Re-enable Geo Location.

Possible solutions (they may exist):

• In given time-frame disable Geo Location (time based rules) in firewall configuration equally to the checkbox: ‘Use time constraints’. I can the update in this time-frame.
• Port knocking (private interface): API with API-key to trigger turn of Geo Location-15 minutes. The automaton can then “knock”, and update in the 15 minute frame.

The question

If there is a solution to automate the “on/off Location Block” while updating please point me in the right direction. Otherwise this is a feature request.

Best regard

Me.

[jon]

I found this while searching the Community:

Automated Let's Encrypt Renewal for DMZ Servers Behind IPFire

Hello IPFire Community, Long time, no see! I’d like to share a solution I’ve developed for a challenge others might face when running secure web services in Orange (DMZ) networks. The Problem I run a personal website in my IPFire Orange network with very restrictive security policies: Strict geolocation blocking to prevent access from unwanted regions No permanent NAT forwarding on port 80 for security reasons TLS termination on the server (not using IPFire as a reverse proxy) Manual certif…

PS - I have not tried this…

[cfusco]

Hello @jon, hope you are doing well.

I can confirm that the code has been running on my Ipfire Apu2 without any apparent bug or problem.

[ms (Michael Tremer)]

@jensse

First thank you for a great firewall of software, that balance the “don’t make me think” with “Let me do what i need”.

Haha, we should print this on a poster.

@jensse

Situation:
I use LetsEncrypt on my webserver(s), when i want to update my certificates i need to turn off Location Block, due to the way LetsEncrypt validation infrastructure works. I do not want to run without LocationBlock, as this impose a significant rise in traffic and exposure from unwanted sources.

I suppose you are blocking the US? Where is their stuff hosted? AWS?

[firewire (Martin Koller)]

Certificate renewal with location block enabled does not work, even with letting through the correct countries. You may want to try switching off location block generally and use “positive lists” for accessing HTTP/HTTPS. In that case you may want to generate two locations groups, one for HTTP-forwarding/HTTPS for “allowed countries” and one for HTTP only access with the US, SG and SE in the list for letsencrypt certificate renewal.

These three countries (US, SG, SE) are currently sources when renewing letsencrypt certificates, however, that may change in the near future.

Downside of this is that enabled (hidden) VPN ports are generally open to the public as they are not being covered by an enabled location block list.