IPv6 Networks in Access Control Lists

Country IP Blocks has just released our beta version of IPv6 by country database. As IPv4 addresses are technically exhausted, IPv6 addressing is coming in to vogue.

We are currently in phase one of our IPv6 ACL release. While the data is accurate, we still consider phase one as a testing phase. In phase one we are offering IPv6 addresses that are updated every four hours. This data will initially be offered as a free service to our licensed and unlicensed website users.

Initially, our IPv6 data will only be offered in three formats: Apache .htaccess Deny, Apache .htaccess Allow and CIDR.

We look forward to hearing your comments.

Aggregating IP Networks for More Efficient Access Control Lists

When it comes to network security and specifically the use of Access Control Lists, Network Managers, IT Managers and those managing inbound access can have their hands full when they create ACLs containing large amounts of data. For example, if you created an ACL to allow only the US and Canada the list may contain close to 80,000 networks. This requires 80,000 lines in your ACL.

Large ACLs may become unruly, cumbersome and difficult to manage. They also can be a drain on hardware and software resources, taxing memory while overloading some firewalls. Aggregation is the solution.

Aggregating these IP ranges offers an excellent remedy to this problem. Aggregation is an excellent solution to reducing the size of large Access Control Lists.

Network Aggregation is not a summary of networks within your ACL. Network Aggregation is a method used to consolidate your Access Control Lists. It accomplishes this by combining contiguous networks within your Access Control Lists into as many larger network ranges as possible. After consolidation, the result is then converted into valid IP networks.

For example, if you had the following two networks: and you could aggregate them and the result would be

Aggregating the US and Canadian networks currently reduces the size of your Access Control Lists by 71%, while still maintaining the exact same number of IP addresses.

Another excellent example of the power of aggregation is the networks assigned to Italy. As of today, April 10, 2019, Italy has 171,995 networks assigned (more if you look at network reassignments and further subnetting). Imagine working with an Access Control List containing this many lines. If you aggregate these networks you can reduce the size of your ACL by 96.9% or to 5,325 lines. An incredible improvement.

Currently, Country IP Blocks includes our Aggregation Module with new license purchases.

Make your network security more efficient by using aggregation.

OFAC Access Control Lists

We are pleased to announce that we are offering free OFAC Access Control Lists, based on OFAC’s Sanctions Programs and Country Information. Unlicensed users will have access to data that is at least 90 days old. Our licensed users will have access to data that is no more than four hours old.

While we are currently offering this data free for licensed and unlicensed users, the data will eventually require a separate license and may be removed from unlicensed access. This is due to additional staff hours to complete the extra work involved in maintaining the OFAC lists.

OFAC list users will be able to select lists including countries with comprehensive sanction, related sanctions or both. The free selections are located here: Create an Access Control List to Block OFAC Sanctioned Countries. Licensed users will find the webform in their control l=panel under the Access Control Lists navigation.

We will base our country selections on OFAC’s page:
Sanctions Programs and Country Information

We will maintain our OFAC ACLs based on OFACs regular updates to their sanctions programs. We recommend you check back often for changes.

Country IP Blocks updates their Country Network database at least every four hours for licensed users. Therefore, data is subject to change frequently. You may purchase your licenses on our website.