Is there a way I can block entire countries by country code (such as RU and CN)?

Currently I have a UFW firewall rule enabled for every IP that tried to do shady stuff (logging in on SSH, searching for .php scripts on my nginx).

Is there a way I could block entire countries from accessing my SSH / Nginx?

This is my nginx access.log (in /var/log/nginx/access.log)

I'm trying to get a solution that blocks on country code, and not IP.

This can be done if you have modsecurity-crs installed.

Big picture, you set up nation blocking in modsecurity by activating the Block Countries feature. You will need the GeoIP database.

Once that is working, you can also ban IP addresses from those countries by adding a modsecurity rule to fail2ban (if you have that installed).

If this approach sounds like it would work for you, ping me in comments and I can expand with details.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.