Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the best way to block country ips (Block many countries completely) to deny access to website running on Windows Server 2008? Currently the module in IIS is blocking the country ips, but I don't think that is the best way to do as request is already reaching the IIS and consuming its resources. I am looking for other alternatives to block country ips (The ip ranges are in thousands) in Windows firewall. Will Windows firewall be a performance bottleneck to filter thousands of ips? Does anybody know the best pattern to easily manage and handle such situation?

share|improve this question

closed as not a real question by Brent Pabst, Scott Pack, Tom O'Connor, mdpc, Ward Jan 10 '13 at 5:03

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

You should really do this type of blocking before the request even gets onto your local network, this is usually done with a physical firewall device. Moreover, why are you blocking a bunch of countries? – Brent Pabst Jan 9 '13 at 15:40
The reason for blocking many countries is because service is only for North America and there are some countries which create unnecessary spams and eating up bandwidth. – Kumar Jan 9 '13 at 16:16
Why -1. I just asked how to block a country to access any website. – Kumar Jan 10 '13 at 14:39
up vote 2 down vote accepted

If you want to block them, but you're concerned about the resources being used even when the firewall rejects the request, then you'll have to ask your ISP to do it upstream. There's no other way around it.

And just so you know, if it's a DDoS or similar that you're worried about, the right way to do it is to have your ISP block it on the backbone.

share|improve this answer

You should be blocking this at the edge of your network instead, through your corporate firewall. If you aren't responsible for this then get with the team that is.

If you are responsible, you'll need to research how to do it for your particular firewall.

For instance, Cisco has a great blog on this with links/details:

If you are already blocking it sufficiently with the simple IP range block in IIS, then transfer that knowledge up the line to the firewall instead.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.