Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

how I can block a whole host (internet provider), or allow only one country for ssh login?

share|improve this question

migrated from Jun 13 '10 at 17:36

This question came from our site for professional and enthusiast programmers.

1.) Lookup the IP addresses of a specific ISP:

You'll have to use Google and search WHOIS records. You can also get hold of an ip2location database which should help.

2.) The command you need is: $ iptables -A INPUT -s -j DROP

Replace the IP ( with your start IP of the range to block and the number afterwards with a netmask (see: to work out what number you need) depending on how far you want to go, block-wise.

share|improve this answer

iptables GeoIP extension allows you to create rules matching by country. Unfortunately GeoIP is not part of standard iptables/netfilter, so you need to hack around a bit to get it enabled.

Here's a tutorial for Debian 5.0.

share|improve this answer

In blogama you can pick the country you'd like to block. (i.e)

CN China

Now, if you want to get the whole IP range for China, just query in the following address 

I found this a little bit tedious, so I made a script:

    #!/usr/bin/env ruby

    %w(uri net/http optparse).each {|r| require r}

    options = {}

    optparser = do |opts|

      opts.banner = "Usage: #{File.basename($0)} [options]"
      opts.on('-c','--country COUNTRY', 'Country to generate iptables rules ie: CH') do |f|
        options[:country] = f

      options[:list] = false
      opts.on('-l','--list', ' List all countries') do |r|
          options[:list] = true

      opts.on_tail('-h','--help', 'Show options') do |o|
        puts opts



    if ARGV.length == 0
      puts optparser

    url = ''
    list = Net::HTTP.get(URI.parse(url))

    if options[:list]
      puts list

    query = '' + options[:country]

    Dir.mkdir("blocked") if !"blocked")
    f ="blocked/" + options[:country] + ".block","w")

    range = Net::HTTP.get(URI.parse(query))
    ips = range.split(/\n/)
    ips.each do |ip|
      rule = "iptables -A INPUT #{ip} -j DROP\n"

The script will generate a list with the iptables syntax, based on the country you picked.Afterwards you can add that file to your rules

# Blocked IP range
. ./ipblock

Caveat: Too many rules will make you connection slower because the incoming packets will be matched against every rule you added.

share|improve this answer is now a parked domain. this could be a good alternative: – booyaa Dec 7 '11 at 12:31
thanks for the info, I did not know it. – Sergio Galvan Dec 9 '11 at 12:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.