For services with a clearly defined legitimate audience, blocking traffic from entire countries or IP ranges at the firewall level can reduce unwanted traffic and certain classes of attacks. This guide covers implementation and its real limitations.
When Country/IP Blocking Makes Sense
- Your legitimate user base is genuinely concentrated in specific regions
- You're seeing consistent attack traffic from specific IP ranges/regions with no legitimate use case there
- Regulatory or business requirements dictate restricting access from certain regions
Important Limitations to Understand First
IP-based geolocation isn't perfectly accurate, and determined attackers/VPN users can trivially bypass country blocking — this is a blunt instrument that reduces volume from unsophisticated sources, not a robust security control against a determined, capable attacker.
Step 1 — Obtain a GeoIP Database
sudo apt install geoipupdate -yConfigure with a GeoIP database license (several free and paid options exist) to get country-to-IP-range mapping data.
Step 2 — Blocking with iptables and ipset (Efficient for Large Lists)
sudo apt install ipset -y
sudo ipset create blocked_countries hash:netPopulate the ipset with IP ranges for countries you want to block (derived from your GeoIP database), then reference it in an iptables rule:
sudo iptables -A INPUT -m set --match-set blocked_countries src -j DROPStep 3 — Blocking at the Nginx Level (Application-Layer Alternative)
See How to Set Up Nginx Access Control by IP Address or Geolocation for the GeoIP2 module-based approach directly in Nginx, appropriate if you specifically want to block at the web server layer rather than the full firewall.
Step 4 — Keep the GeoIP Database Updated
sudo geoipupdateIP-to-country mappings change over time as address allocations shift — schedule regular updates (via cron) to keep blocking accuracy reasonably current.
Testing Your Configuration
Use a VPN or proxy service with an exit point in a blocked country to verify the block is actually working as intended before relying on it.
Avoiding Overly Broad Blocking
Country-level blocking is inherently coarse — you'll inevitably block some legitimate users (travelers, VPN users, legitimate business connections) alongside unwanted traffic; weigh this trade-off honestly against your actual security/business needs.
Combining with Other Security Measures
Country blocking works best as one layer among several, not a standalone security solution — combine with rate limiting (see How to Rate Limit an API with Nginx), fail2ban, and standard application security practices.
Common Errors
Legitimate users unexpectedly blocked — verify your GeoIP database is current, and consider whether the specific blocking policy is too broad for your actual legitimate audience's geographic diversity.
Continue Reading
- How to Set Up Nginx Access Control by IP Address or Geolocation
- How to Rate Limit an API with Nginx
- How to Install and Configure Fail2Ban on Ubuntu & Debian
Browse more articles in Networking & DNS.
