Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site that is only relevant to US visitors and would like to block all non-us visitors from accessing the site. What is the best way to do this with iptables given that I have a CIDR list of US ip blocks?

share|improve this question
possible duplicate of Allow a range of IP's with IPTABLES from a file – Bryan May 16 '12 at 21:45
You hould be carefull. THis is a BAD approach - what about Canada? Oh, you say not relevant - what about Montreal, which is RIGHT across the border. Poeople LIVE there and work in the USA ;) What about Panama, where quite some americans live? Even when it is only relevant for the USA; a lot of people live close or across the border. I for example (europe) live in Poland. I am german. I am a LOT in germany. I live not even 10km over the border (fora lot of reasons, including a LOT lower taxes). I do most of my shopping in germany ;) – TomTom May 17 '12 at 4:27
I am might be moving to America soon. I live in Australia. What if I need to research whatever information is on your site? Also, what about people in America, but their ISP has them located in Canada? Peer1 does this. Put a server in their New York DC and you might just end up with a Canadian IP address. – Mark Henderson May 17 '12 at 6:03

The easiest way would be to block all traffic by default and then only allow the US ranges. I've used this website in the past to get the IP ranges of various countries. In iptables you crease an accept rule of $US_IPS and then have them defined. Just as a warning, this is a lot of IPs and could slow down your firewall depending on the hardware specs and the amount of traffic coming in due to the rule having to look through so many IPs each time. If there is some specific IPs that hit your firewall a lot, you may want to put that rule above this accept rule so it won't have to process the huge IP list each time.

share|improve this answer
Not "could slow", "will slow" - but the output is FAR from optimized, e.g. – symcbean May 17 '12 at 12:01

Although it might be easier to block all by default, this also means any newly assigned U.S. addresses would be blocked too unless you were diligent about keeping your tables up-to-date.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.