Like most servers (I assume), we have people trying to brute force our services 24/7. I have cpHulk blacklist their IP's, but it seems like it'd be better if they didn't get that far in the first place. Myself and my host are the only ones who connect to the server on ports other than 80, so I'd like to block connections from all countries outside the US, except for port 80. I contacted my host to set this up, but they were hesitant because they said it would create an exceptionally high server load. It's a dedicated Xeon 1230 server with 32GB RAM running CentOS 6.6 and iptables.
First, any reason not to do this? Second, is what my host told me correct? Third, is there any way to accomplish this without a high performance impact?