We are unable to install Vault on some of our machines because the apt.releases.hashicorp.com repository seems to be geoblocking them. This affects the GPG keys we try to download, as well as the apt repository contents itself.
I appreciate that Hashicorp may need to geoblock certain countries for export control reasons, however, our blocked and un-blocked machines are all located in South Africa, so this seems to be an error.
Failing case:
$ wget -S https://apt.releases.hashicorp.com/ -O-
--2022-05-11 13:41:26-- https://apt.releases.hashicorp.com/
Resolving apt.releases.hashicorp.com (apt.releases.hashicorp.com)... 52.85.218.91, 52.85.218.13, 52.85.218.74, ...
Connecting to apt.releases.hashicorp.com (apt.releases.hashicorp.com)|52.85.218.91|:443... connected.
HTTP request sent, awaiting response...
HTTP/1.1 404 Not Found
Server: CloudFront
Date: Wed, 11 May 2022 11:41:26 GMT
Content-Length: 4063
Connection: keep-alive
x-amzn-waf-reason: geo
Content-Type: text/html
X-Cache: Error from cloudfront
Via: 1.1 60cfeb953c2ce97a8ab845e76ee86370.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JNB50-C1
X-Amz-Cf-Id: Kd-Umktifm3cTJGMasrkuqRFIv3p8eSkZ2NmoGVdYQAF-rSQh2u7lQ==
2022-05-11 13:41:26 ERROR 404: Not Found.
The x-amzn-waf-reason: geo header makes me suspect geoblocking, although according to How AWS WAF works with Amazon CloudFront features - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced that is supposed to result in a 403 error, not a 404.
The above output is from 156.38.231.34, which is located in Midrand, South Africa.
WHOIS record:
NetRange: 156.38.0.0 - 156.38.255.255
CIDR: 156.38.0.0/16
NetName: AFRINIC-ERX-156-38-0-0
NetHandle: NET-156-38-0-0-1
Parent: NET156 (NET-156-0-0-0-0)
NetType: Transferred to AfriNIC
OriginAS:
Organization: African Network Information Center (AFRINIC)
RegDate: 2010-11-03
Updated: 2010-11-17
Comment: This IP address range is under AFRINIC responsibility.
Comment: Please see http://www.afrinic.net/ for further details,
Comment: or check the WHOIS server located at whois.afrinic.net.
Ref: https://rdap.arin.net/registry/ip/156.38.0.0
ResourceLink: http://afrinic.net/en/services/whois-query
ResourceLink: whois.afrinic.net
OrgName: African Network Information Center
OrgId: AFRINIC
Address: Level 11ABC
Address: Raffles Tower
Address: Lot 19, Cybercity
City: Ebene
StateProv:
PostalCode:
Country: MU
RegDate: 2004-05-17
Updated: 2015-05-04
Comment: AfriNIC - http://www.afrinic.net
Comment: The African & Indian Ocean Internet Registry
Ref: https://rdap.arin.net/registry/entity/AFRINIC
ReferralServer: whois://whois.afrinic.net
ResourceLink: http://afrinic.net/en/services/whois-query
OrgAbuseHandle: GENER11-ARIN
OrgAbuseName: Generic POC
OrgAbusePhone: +230 4666616
OrgAbuseEmail: abusepoc@afrinic.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/GENER11-ARIN
OrgTechHandle: GENER11-ARIN
OrgTechName: Generic POC
OrgTechPhone: +230 4666616
OrgTechEmail: abusepoc@afrinic.net
OrgTechRef: https://rdap.arin.net/registry/entity/GENER11-ARIN
This output is from a machine that is not blocked:
$ wget -S https://apt.releases.hashicorp.com/ -O-
--2022-05-11 11:16:16-- https://apt.releases.hashicorp.com/
Resolving apt.releases.hashicorp.com (apt.releases.hashicorp.com)... 52.85.218.91, 52.85.218.13, 52.85.218.74, ...
Connecting to apt.releases.hashicorp.com (apt.releases.hashicorp.com)|52.85.218.91|:443... connected.
HTTP request sent, awaiting response...
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 71
Connection: keep-alive
Last-Modified: Thu, 23 Apr 2020 19:32:37 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Wed, 11 May 2022 09:16:18 GMT
Etag: "587dededfd4a3ea70ef2fd6487c35d43"
Via: 1.1 60cfeb953c2ce97a8ab845e76ee86370.cloudfront.net (CloudFront)
X-Frame-Options: sameorigin
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Cache: RefreshHit from cloudfront
X-Amz-Cf-Pop: JNB50-C1
X-Amz-Cf-Id: DG0-B8xQwQaZPXKaJWnkcfMiaZy115TtvkQ33uhSEfpY44ka-y_DyA==
Length: 71 [text/html]
Saving to: ‘STDOUT’
- 0%[ ] 0 --.-KB/s <html>
<body>
<h1>Hashicorp Public Linux Repo</h1>
</body>
</html>
- 100%[=======================================================>] 71 --.-KB/s in 0s
2022-05-11 11:16:17 (8.50 MB/s) - written to stdout [71/71]
The above output is from 102.141.183.173 The WHOIS is:
NetRange: 102.0.0.0 - 102.255.255.255
CIDR: 102.0.0.0/8
NetName: AFRINIC-102
NetHandle: NET-102-0-0-0-1
Parent: ()
NetType: Allocated to AfriNIC
OriginAS:
Organization: African Network Information Center (AFRINIC)
RegDate: 2011-02-10
Updated: 2011-02-10
Comment: This IP address range is under AFRINIC responsibility.
Comment: Please see http://www.afrinic.net/ for further details,
Comment: or check the WHOIS server located at whois.afrinic.net.
Ref: https://rdap.arin.net/registry/ip/102.0.0.0
ResourceLink: http://afrinic.net/en/services/whois-query
ResourceLink: whois.afrinic.net
OrgName: African Network Information Center
OrgId: AFRINIC
Address: Level 11ABC
Address: Raffles Tower
Address: Lot 19, Cybercity
City: Ebene
StateProv:
PostalCode:
Country: MU
RegDate: 2004-05-17
Updated: 2015-05-04
Comment: AfriNIC - http://www.afrinic.net
Comment: The African & Indian Ocean Internet Registry
Ref: https://rdap.arin.net/registry/entity/AFRINIC
ReferralServer: whois://whois.afrinic.net
ResourceLink: http://afrinic.net/en/services/whois-query
OrgTechHandle: GENER11-ARIN
OrgTechName: Generic POC
OrgTechPhone: +230 4666616
OrgTechEmail: abusepoc@afrinic.net
OrgTechRef: https://rdap.arin.net/registry/entity/GENER11-ARIN
OrgAbuseHandle: GENER11-ARIN
OrgAbuseName: Generic POC
OrgAbusePhone: +230 4666616
OrgAbuseEmail: abusepoc@afrinic.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/GENER11-ARIN
To note, our servers in AWS af-south-1 datacenter (Cape Town, South Africa) also have no issue accessing it.