Country blocking
4 answers
Cutting scanner noise and meeting a rule about where you serve.
Looking for something specific
The searchable index covers all 326 answers at once and filters as you type.
224 Block a country
- Settings, Country database. Choose db-ip, which is free with no account, or MaxMind if you have one. Save, then Install it now.
- Open the site, Geo blocking tab.
- Untick the countries you do not want. Ticked countries can reach the site.
- Save and apply.
A VPN gets around this in one click, so it is for cutting scanner noise and meeting a rule about where a site may be served, not for keeping anybody determined out.
225 Set up the country database
Settings, Country database. db-ip publish one every month and ask for nothing but attribution. MaxMind GeoLite2 is free but needs an account.
Both publish monthly, so a monthly refresh is plenty. Daily costs a download and finds nothing new most days. The active node does it for the whole fleet.
226 Country blocking does not work behind my CDN
The address nginx sees is the CDN's, so you are looking up the wrong country entirely. Turn on the setting that trusts the real client address from a header, and only when you know exactly what is in front and have named it as trusted.
227 How accurate is country blocking?
Right most of the time and wrong some of the time. Addresses move between regions, mobile carriers route traffic through unexpected places, and corporate VPNs make a person in one country look like they are in another. Expect a small number of legitimate visitors to be refused, and decide whether that is acceptable before turning it on for a public site.