Firewall - Country Blocking - Enhance Control Panel

Firewall - Country Blocking

DracoBlue

Firewall - Blocking IPs from countries you don't want to access your website. This can be done using two-letter country codes from ISO 3166. I believe it would be a good solution for blocking spam-prone countries.

website: https://db-ip.com/

twest

It's possible to do that in UFW (default Ubuntu firewall) already. There's a lot of tutorials available:
https://www.ustoopia.nl/technical/tips-and-tricks/block-countries-based-on-geo-data-with-ufw-firewall/

I handle this at the DNS level in Cloudflare. Part of why I want my entire stack protected by Cloudflare. But it could be a good idea to block countries at the server level too, just in case a bad actor got a hold of your origin ip.

DracoBlue

I receive a lot of spam from Russia, China and I would like to block these countries from incoming calls

8Dweb

Opsshield also has this option. Choose your server, go to settings, then select Security Tools, and select countries under, IPDB Country Blacklist.

So far seems to work fairly well.

I think I would like to have this option in the stock installation of Enhance along with much more granular control over the firewall from the interface.

MediaServe

cPGuard (Enhance compatible) has this built in FWIW.

Oops 8Dweb beat me to it!

DracoBlue

Cloudflare have good tools. It would be nice if we could see something similar in the Enhance panel. Unfortunately, cloudflare only blocks sites that have cloudflare proxy enabled.

twest

DracoBlue I think the problem with local solutions is that it is a huge amount of data to store, and you have to keep updating the data to assure correct ip range placement for various countries, and if you'll be filtering every request to check against your IP database that will add a large load to your server and pagespeed times. I really like the Cloudflare solution since it offloads all the negatives of running such a feature to cloudflares servers, and doesn't seem to effect page load times.

josedieguez

i think is much better to use CloudFlare DNS, and use their Country blocks/challenges than creating so many rules in your firewall, using your own resources.