Country blocking

Turn it on#

Under Settings › Agent, Blocked countries: search for a country by name and add it; each blocked country shows as a chip you can remove. The setting applies to every server of the organization. From the attack map on the Overview, Block country blocks a country in one step (owners and admins, Pro and higher), and appears in Activity with Undo.

One server only#

On a server's page, Network tab, Blocked countries on this server only: the same country search, for countries blocked on that server in addition to the ones blocked on every server, which are listed above it with a link to Settings › Agent. Owners and admins change them, on Basic and higher plans (on Starter a list kept from a paid plan is shown but not applied); members see them. The server receives both lists together, so it needs nothing more than for the organization's list (agent 1.0.33 or later, ipset), and the same exceptions apply. From the attack map, Block country can also block a country only on one of the servers it attacked. AutoMode and the emergency mode block countries on every server only and never change a server's own list.

What the server needs#

• A country database. Agent 1.0.33 and later download it from the dashboard as soon as a country is blocked, and only then, to /etc/infrafence/geoip-country.mmdb, and look for a new edition at most once a day. A downloaded file is checked before it replaces the one in use; when a download fails the agent keeps the previous file and tries again later. To use your own database in MaxMind format, set GEOIP_DB_PATH: nothing is downloaded then. Older agents only read /etc/infrafence/GeoLite2-Country.mmdb, installed by hand.
• ipset, to block whole countries at the firewall.

Country data: IP to Country Lite by DB-IP, licensed under CC BY 4.0.

How it works#

1. At the firewall: every network of the country, taken from the database, goes into an ipset named infrafence-geo-<code> (for example infrafence-geo-cn), dropped from the INFRAFENCE chain. Nothing from that country reaches the server. Each set is sized to its country, so even the largest, the United States (about 155,000 networks), loads in full (agent 1.0.33 and later).
2. In the logs: an address from a blocked country that shows up in the SSH, web, mail, database or FTP logs is banned at its first attempt.

Without ipset only the second layer works, and the log says: country blocks NOT applied at kernel level (falling back to reactive per-IP blocking).

Exceptions#

Whitelisted addresses and networks are never blocked by country, and neither are the dashboard's address and the server's own addresses. SSH sessions open when a country's block is applied keep working: their addresses are left out of the country set (a new login from that country is blocked). In monitor mode no country set is applied.

Before blocking a country, remember that customers and colleagues travelling there lose access too. The emergency mode and AutoMode never block a country that SSH logins come from.