We have a firewall rule to block all inbound from outside the UK using Country Objects. We had a user today who was unable to connect into the office, I can see in the syslog the firewall rule is blocking her but when I lookup her IP every site is saying its a UK IP. Is there a way to tell from the syslog what country the Draytek firmware thinks the IP is in so I can add that country to the rule?

[FILTER][Block][WAN->LAN/RT/VPN, 983:04:24 ][@S:R=2:3, 45.89.X.X:50260->192.168.X.X:443][TCP][HLen=20, TLen=52, Flag=S, Seq=2972358332, Ack=0, Win=64240]

Guessing that 45.89.X.X is the source IP address (only a guess mind) an IP lookup suggests a number of possible countries. Perhaps you can narrow it down if you know the X and X?

No, there is no way of checking what Country DrayOS thinks you're in that I am aware of. Maybe there is a CLI command for it. Draytek uses a 3rd party IP list and that list is point in time. It becomes outdated quite quick as IP blocks are sold between ISPs globally all the time. The Country IP list in DrayOS is only updated when new firmware is released and there is no guarantee each firmware has an updated Country IP list baked into it.
 

Guessing that 45.89.X.X is the source IP address (only a guess mind) an IP lookup suggests a number of possible countries. Perhaps you can narrow it down if you know the X and X?

Sorry I swapped the actual IP for X's to hide it, I have looked it up on several sites but all say its a UK IP.

pharcyder post=103561 userid=38192No, there is no way of checking what Country DrayOS thinks you're in that I am aware of. Maybe there is a CLI command for it. Draytek uses a 3rd party IP list and that list is point in time. It becomes outdated quite quick as IP blocks are sold between ISPs globally all the time. The Country IP list in DrayOS is only updated when new firmware is released and there is no guarantee each firmware has an updated Country IP list baked into it.
 

That's a shame, I was hoping that syslog would tell me, or there being some kind of inbuilt query I could do via telnet

A shame , but I suspect pharcyder is right. Some time ago my ISP (Zen) decided to change the block of IP's I had had for years and re-issue me with different ones. They claimed this had something to do with the "lack of IP4 addresses" issue but since they gave me the same number of addresses as I had previously I was always dubious about this. In any event, for some months afterwards several sites thought I was in Chicago (including test IPv6 sites and the National Lottery - the latter saved me money as I was unable to buy tickets "not being in the UK" ) Only over several months have things slowly resolved themselves.