Member Avatar for klon_80

Hi,

How to block block all China and Arabs IPs in windows server 2003 R2? what firewall can block the country's?

Thank you!

  • 3 Contributors
  • 2 Replies
  • 114 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Networker1

Dani AI

Generated

Blocking entire countries by IP ranges is possible, but it is best done at the network edge (router/CDN/WAF) rather than only on the Server 2003 host. As warned, country CIDR lists are large and change often; blocking blindly can cut off legitimate users. As suggested, combine any IP blocks with rate limits and account lockout rules so attackers cannot simply shift to proxies or credential stuffing.

Practical options, in order of effectiveness:

  • Put a GeoIP block on a CDN or cloud WAF (fast to deploy, easy to update).
  • Enforce at the perimeter firewall or edge appliance (pfSense with pfBlockerNG, commercial firewalls that support GeoIP).
  • If you must block on the server, use IIS IP restrictions or an IPsec filter list, but be prepared to script regular updates from a GeoIP provider.

Where to get ranges and tools:

  • Use a maintained country-to-CIDR feed (for example, MaxMind GeoIP/GeoLite data) and update nightly or weekly.
  • If you control the router/firewall, import the CIDR feed into the appliance (pfSense/pfBlockerNG or ipset on Linux are common choices).
  • If using a CDN/WAF, create a country-based rule rather than importing thousands of CIDRs.

Operational checklist:

  1. Measure current traffic from target countries (analytics / IIS logs) before blocking.
  2. Test with a soft block (challenge or 403 for one virtual host) and monitor results.
  3. Keep a whitelist for admins and known partners.
  4. Automate updates and monitor false positives; attackers can use VPNs and botnets, so also enforce strong authentication and lockout policies.

References: MaxMind GeoLite2 country data (https://dev.maxmind.com/geoip/geoip2/geolite2/), Cloudflare Firewall docs (https://developers.cloudflare.com/firewall/), pfSense pfBlockerNG docs ().

Recommended Answers

All 2 Replies

Member Avatar for blud

Most people would use just windows firewall or some other firewall software. The list of ips allocated to china can be found Here. Keep in mind they make up a good portion of the internet, so if your running a site that rely on visitors, you may want to double check how many of your users are in these subnets before blocking them.

Member Avatar for Networker1

I guess you are getting scanned by IP's from this countries... You can create rules on your firewall to block the segments, but like blud said, be carefull. Also it would be wise to also configure logon restrictions in order to disable or prevent future logons from usernames that fail to logon succesfully after a said number of attempts.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.