Security
Country blocking
Tick the countries that may reach a site. Untick one and requests from it get a 403 before they touch your application.
Be honest about what this is for
A VPN gets around this in one click
Country blocking is for cutting scanner noise and for meeting a rule about where a site may be served. It is not for keeping anybody determined out. Anyone who wants past it is past it in seconds, and anybody who tells you otherwise is selling something.
What it does do well:
- Reduces log noise enormously. A large share of automated probing comes from a small number of places, and not having it in your logs makes the real events easier to see.
- Takes load off the backend. A 403 at the edge costs almost nothing compared to a request that reaches your application.
- Satisfies a genuine requirement. Some agreements say a service may only be offered in certain countries, and this is a reasonable way to implement that.
The country database
Blocking needs a database mapping addresses to countries, and it has to be on every node, because a node without it refuses the whole configuration and the apply is turned away.
| Source | Cost | Notes |
|---|---|---|
| db-ip | Free, nothing to sign up for | Published monthly. Licensed CC BY, so credit them if you publish anything derived from it. |
| MaxMind GeoLite2 | Free, needs an account | Pick this if you already have an account or prefer theirs. |
Both publish monthly, so a monthly refresh is plenty. Daily costs a download and finds nothing new most days. The active node does the download for the whole fleet.
Accuracy
Address to country mapping is right most of the time and wrong some of the time. Addresses move between regions, mobile carriers route traffic through unexpected places, and corporate VPNs make a person in one country look like they are in another. Expect a small number of legitimate visitors to be refused and decide whether that is acceptable before you turn it on for a public site.
Behind a CDN
If something sits in front of your load balancers, the address nginx sees is the CDN's, and country blocking will be looking at the wrong country entirely. Turn on the setting that trusts the real client address from a header first, and only when you know what is in front and have named it as trusted.
Common questions
Does this affect health checks or peer traffic?
No. Blocking is applied to site traffic. Cluster peers and management networks are handled separately.
What do blocked visitors see?
A 403, or your error page template if the site has one covering 403.
Can I allow one country for one path and not the site?
The country list is per site. For a narrower rule, use an access list on the path instead.
Step by step instructions
The how to section has searchable, task shaped answers. Search it for country.
Related features
Access lists
Who may reach a site, by address, with a password on top.
Read moreWeb application firewall
ModSecurity with the OWASP Core Rule Set, per site.
Read moreRate and connection limits
Cap how fast and how much one visitor can ask for.
Read moreLogin watch
Catch password spraying, not just brute force.
Read more