Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does it ever make sense to block an entire address range, lets say the IP address range India? We don't serve anybody out of the country, and have been getting disproportionate amounts of traffic on our website from there. Is this an overly heavy-handed approach?

share|improve this question
    
Do you mean a web site when you say big amounts of traffic? –  Anonymous Feb 21 '10 at 15:07
    
Yes - edited the question to be clearer. Thanks! –  ro. Feb 24 '10 at 3:16
1  
If you're only serving sites to your own country then it might be simpler to allow only those addresses used by your country, rather than to exclude others. –  John Gardeniers Feb 24 '10 at 3:51
add comment

1 Answer

If you don't serve anybody outside the country anyway, then no, it's not disproportionate. And I'd block Africa, China and Russia as well. But be aware that one can still access your page via a proxy in your country.

http://ip-to-country.webhosting.info/downloads/ip-to-country.csv.zip?XID=4e7c21db6454b8ccae4c25b4ac693cf6

Just remember that IP blocks can shift, so be sure to update your firewall-rule periodically.

share|improve this answer
2  
Do you happen to know how the IP blocks can shift? Does this happen unpredictably, or are IP's periodically reallocated? –  ro. Feb 24 '10 at 3:16
    
I am not sure about that, but I assume IANA can reassign IPs after a contract expires. Since a contract can expire anytime, it would seem to be unpredictable (but it's safe to assume that major shifts don't happen very often). Also, every posessor of big IP blocks can do so, for example internet service/backbone providers. Maybe you should write a script, which downloads ip-to-country.csv every week/month and updates your firewall rule. However, make sure that script is bug-free. –  Quandary Feb 27 '10 at 7:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.