Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to prevent people from certain countries from visiting my website - but I want to allow some defined IP addresses from those countries to be able to access it. Is it possible? If yes, how?

share|improve this question

migrated from stackoverflow.com Jul 16 '09 at 22:41

This question came from our site for professional and enthusiast programmers.

1  
If I may ask... why would you want to? –  baudtack Jul 31 '09 at 5:13

5 Answers 5

You could deny access to a range of IP addresses known to originate from that country, while using a white list to enable access to those specific IP addresses which you want to allow. However, this could easily be subverted by, for example, using a proxy from a different country, or simply by going to a different country and then viewing the website from there. This is probably more trouble than it is worth.

Also, you might want to verify that you are legally permitted to deny access on a country-wide basis. Not to mention, of course, the ethical implications of discriminating against users on the basis of nationality.

share|improve this answer
    
Thanks. Just want to be able to prevent spam from certain countries. Is it really true that this could be illegal? Do you mean there could be rules and regulations that the domain name authorities ask domain name owners to follow? –  rajats9999 Jul 16 '09 at 2:37
    
And in a couple of countries' cases, we have partnerships which require us to not launch independently there. For them at least, is that not a valid reason? This might be too much legalese, but still thought I shd mention. –  rajats9999 Jul 16 '09 at 2:40
    
I don't think blocking certain countries is ilegal, because major websites such as pandora, hulu, and etc do. –  Mohamed Jul 16 '09 at 2:58
    
Lots of companies do lots of illegal things, until they get sued. –  Lee B Oct 29 '09 at 6:42
3  
It's not generally illegal to block geographic IP blocks. Ignore anyone who claims it is. Speak to your corporate legal representative, NOT random interweb dudes with an axe to grind, about any particular legalities that may apply to your specific situation. –  RobM Nov 6 '09 at 7:24

This is going to be pretty tough as a user could still use a proxy to bypass any checks you have that look at IP/location.

share|improve this answer
    
Thanks. Can I make a proxy sitting in one country that looks like an IP address from another country? –  rajats9999 Jul 16 '09 at 2:38
    
@rajats9999 - of course you can. This is trivial to do. Country assignments are not 100% reliable by any means. And more to the point, someone in America can create a proxy and leave it 'open' to the world and I can connect from here in the UK... and for all intents and purposes, on the internet I am now American... voila. –  RobM Nov 6 '09 at 7:32

You could use some data like this: http://www.ipinfodb.com/

When you have that in place, you check to see if your guest matches a banned location, and if they do, only allow them if they are on a white list of ips.

Of course, nothing you do will stop people from using a proxy if they really want to.

share|improve this answer

The easiest way to solve this problem, using data like this(Click download on right-bottom of webpage) for converting user ip to country.

share|improve this answer

I'd write some iptables (or use another type of firewall) and say :

allow all, block this range EXCEPT if the IP can be found in my whitelist

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.