Slashdot Mirror

No need to block entire countries - just allow SSH access to those systems that need it.

Now, if you want to talk about blocking access to your web or mail server from anyone in East Elbonia, then you can implement a package like Country Block, or use a service like this one, depending on your firewall.

The lesson from this? Restrict access to important services via a whitelist, block access to public services with a deny list.

https://www.countryipblocks.net/

Then pick a format you want to block with. I personally use the shorewall firewall and put them in the blacklist and keep all the traffic out (that wasn't requested by me first)

http://www.countryipblocks.net/, for the next couple of days anyway. Looks like they're closing up since nobody donates.

In addition to blocking unwanted open ports to the world, have just about all of China's IPs in my ipfilter, denying them access to anything but HTTP (they might want to read my blogs...right?). Also the other countries called out by http://www.countryipblocks.net/malicious-internet-traffic/malicious-internet-activity-the-top-10-countries/ are likewise blocked. Yeah, that's about 10K IP blocks in the filter, but it seems to run just fine, and I end up with only sporadic and apparently random (or maybe successful) failures in my auth files.

Not that I want anyone to see this as any kind of challenge...I'm sure someone is spending more time to access and zombie my machines than I'm spending to try to cut them off!

Custom hosts ? I just get lists of a country's CIDR ranges from guys like http://www.countryipblocks.net/ . If I'm getting frequently attacked from certain countries, and they're not part of my "target demographic", so to speak, I just block them at the firewall. I know I have no interest in selling to or working with people outside north america and a handful of western european areas, and I'm perfectly content to accept the potential loss of outside business, so I block their SMTP, and serve a different web site to their IP ranges explaining how and why my services aren't available in their area.

I use the service from http://www.countryipblocks.net/ to create rules in my firewalls to just block out China, Korea, an Russia. This cuts down significantly the hacking attempts on my servers. Its time to reject buying anything "Made in China" to show them that this kind of behavior is unacceptable.

Time to block Iran then.

If you're running a website, is there a way to detect visitors who are (probably) in Pakistan

http://www.countryipblocks.net/
took less than 5 minutes in some search engine.

I use http://www.countryipblocks.net/ -- they seem to do a pretty decent job of keeping their database up-to-date. It will also provide the output in varying formats (net/mask, CIDR, ip range, etc).

Nope, a host file is static and wont support and wildcards like *.cm.

You can run bind and play with the configuration or you can set your firewall to not let you make connections to cameroon's netblocks. That's assuming the cm stuff is actually hosted there. If not then you need to block via DNS.

# Country: CAMEROON
# ISO Code: CM
# Total Networks: 16
# Total Subnets: 100,864
41.92.128.0/17
41.190.224.0/22
41.191.100.0/22
41.202.192.0/19
41.204.64.0/19
41.205.0.0/19
41.205.64.0/19
41.211.96.0/19
41.216.176.0/20
41.217.128.0/19
41.223.28.0/22
193.17.215.0/24
195.24.192.0/19
195.234.120.0/22
196.3.90.0/24
196.202.232.0/21

http://www.countryipblocks.net/country-blocks/select-formats/