I have a Ubuntu 14.04 server which runs a game server and it's under heavy DDos attack right now. It's not a English-speaking community, so I don't need access from any other countries but mine. All of the attacking IPs are from different countries, except for my country.

So, I thought that I might block access from all countries except for mine to defeat DDos by iptables or something. What is the easiest way for this?


closed as off-topic by Greg Askew, fukawi2, mdpc, Hyppy, Michael Lowman Feb 4 '15 at 23:05

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Greg Askew, fukawi2, mdpc, Michael Lowman
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    iptables was not design to identify country of IP, it's up to you to do that. – alexus Feb 3 '15 at 21:34

There are a variety of resources online for finding the IP blocks allocated to countries (generally for blocking purposes). Assuming you have adequate hardware router capacity or are running your routing on an adequate PC, you'd need to get the IP blocks for your country, set up a hardcoded remote access address for yourself, then set up rules to allow connections from IP blocks assigned to your country while blocking everything by default.

Unless you have physical access, set up your bypass first - it would stink to discover that you made a mistake in your permissions and the only rules being applied are the "block everything" ones.

Finally, if this is really a DDOS, blocking at your local firewall/router is probably not going to be terribly effective - a big part of the effectiveness of DDOS is not that it clogs up your servers (which it does) but that it clogs up the Internet connection from your ISP, or even the connection to your ISP. Filtering of the sort you may require would have to be done "upstream" from your connections.

Not the answer you're looking for? Browse other questions tagged or ask your own question.