Blocking requests from country specific IP's on Web server ?

I need to block out certain IP adresses on a web server depending on where the request comes from (block out entire countries).
Planned to use either pf or ipfw. Os is going to be freebsd or openbsd (not decided yet)

I am thinking that this could be done quite simple in pf but I can't figure out how to do it.

Secondly, a request from such a blocked ip should get redirected to another site, how do I do that ?


Any thoughts or hints?

Thanks in advance

In pf, it is simply a matter of adding a rule like this to /etc/pf.conf (assuming your interface is fxp0 and your IP address is 192.168.0.1)

block in on fxp0 proto tcp from xx.xx.xx.xx to 192.168.0.1 port http

If you want to block the whole class C, you would use something like this:
block in on fxp0 proto tcp from xx.xx.xx.00/24 to 192.168.0.1 port http

The pf guide for OpenBSD is pretty good. See:
http://www.openbsd.org/faq/pf/index.html
and
http://www.openbsd.org/faq/pf/example1.html for some sample rulesets.

thank you for the help. I looked at it and it makes sense, guess I will be able to do it now.

Do you have any comment on the redirecting question ?

Thanks
Dom

Hi

here the IP address range I need to block
(*-ed out the first three digits)
***.139.192.0 -- ***.139.223.255
Now how do I block this range without blocking the entire class C net?