What is the best way to block country ips (Block many countries completely) to deny access to asp.net website running on Windows Server 2008? Currently the module in IIS is blocking the country ips, but I don't think that is the best way to do as request is already reaching the IIS and consuming its resources. I am looking for other alternatives to block country ips (The ip ranges are in thousands) in Windows firewall. Will Windows firewall be a performance bottleneck to filter thousands of ips? Does anybody know the best pattern to easily manage and handle such situation?
closed as not a real question by Brent Pabst, Scott Pack, Tom O'Connor, mdpc, Ward Jan 10 at 5:03
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
If you want to block them, but you're concerned about the resources being used even when the firewall rejects the request, then you'll have to ask your ISP to do it upstream. There's no other way around it.
And just so you know, if it's a DDoS or similar that you're worried about, the right way to do it is to have your ISP block it on the backbone.
You should be blocking this at the edge of your network instead, through your corporate firewall. If you aren't responsible for this then get with the team that is.
If you are responsible, you'll need to research how to do it for your particular firewall.
For instance, Cisco has a great blog on this with links/details: http://blogs.cisco.com/security/block-a-country-with-my-cisco-router-or-firewall/
If you are already blocking it sufficiently with the simple IP range block in IIS, then transfer that knowledge up the line to the firewall instead.