I was DDos Attacked by Chinese Great Firewall twice this year.

Now I download zone file from http://www.ipdeny.com/ipblocks/ .I want to do these things:

  1. If Someone from Anywhere wants to connect to my server's specific port,All can be come in.
  2. If Someone from China wants to connect to my server's any other ports,All packets should be dropped.Anyone else from other country can connect to my server correctly.

How Can I do?

I use a Cloudflare CDN free plan, but I just want to do above things on my server.

  • This sounds like a Cloudflare question? Nov 18, 2015 at 17:01
  • of course not.I just want to ban it on my server.NOT CLOUDFLARE Nov 18, 2015 at 17:04
  • No need to shout. I only asked for clarification. You might be able to get started with cyberciti.biz/faq/block-entier-country-using-iptables Nov 18, 2015 at 17:09
  • Thanks a lot.I'm so sorry.I forget to turn off the upper letters,So lazy I am Nov 18, 2015 at 17:10
  • But I want to allow the banned country to connect to specific port,How should i do? Nov 18, 2015 at 17:12

2 Answers 2


If you are using iptables it will return on the first matching rule. If you want to allow http for example and deny the other ports for China, ensure that the http allow rule comes first:

iptables -A INPUT -d myhost --dport 80 -j ACCEPT
iptables -A INPUT -m set --match-set china src -j DROP

Using the above statements you will need to create an ipset for china using:

ipset create china hash:net
while read line; do ipset add china $line; done < china.ipblock-file

If you want to block using Apache module then you can try this also :

MaxMindDBEnable On
MaxMindDBFile DB /path/to/GeoIP/GeoLite2-Country.mmdb
MaxMindDBEnv MM_COUNTRY_CODE DB/country/iso_code

SetEnvIf MM_COUNTRY_CODE ^(CN|RU|DE|FR) BlockCountry
Deny from env=BlockCountry

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .