Country Blocking

[kearton]

Is anyone else making use of "Country Blocking" in their filter/firewall? If so, what countries do you block?

Logical ones to me might seem to be Yemen/Syria/North Korea? Any others?

Or is this overkill?

[synaesthesia]

We have active blocks on China for spam/security and as it's the IP range that seems to hit on our remote server most often. Could quite happily block Russia for the same reason too.

[Blue_Cookeh]

No, I think it's unreasonable to block entire "countries" for a couple of reasons:

 

- The people in China/Russia etc aren't launching attacks from just their local machines, they're global botnets

- You never know what services you're going to block

- Country information on IP addresses aren't always correct

 

If you've set your firewall up properly and have the IDS enabled I think you're pretty much set anyway.

[Roberto]

Is anyone else making use of "Country Blocking" in their filter/firewall? If so, what countries do you block?

Logical ones to me might seem to be Yemen/Syria/North Korea? Any others?

Or is this overkill?

 

Yes. We block china and a few others.

 

We've seen instances of attacks (from botnets, as has been pointed out) and things such as aggressive robot crawling of websites, and while I'm not *terribly* worried about this from a security perspective as we have IDS in place, it still represents a risk and also in the case of the crawlers, a load that some systems (Cirqa for example) struggle to cope with.

 

Country blocking isn't something I do lightly as I broadly agree with the concerns that @Blue_Cookeh raises, but I do feel that in some cases the risks of allowing connections outweigh the benefits.

Edited January 28, 2016 by Roberto