3

I was DDos Attacked by Chinese Great Firewall twice this year.

Now I download zone file from http://www.ipdeny.com/ipblocks/ .I want to do these things:

  1. If Someone from Anywhere wants to connect to my server's specific port,All can be come in.
  2. If Someone from China wants to connect to my server's any other ports,All packets should be dropped.Anyone else from other country can connect to my server correctly.

How Can I do?

I use a Cloudflare CDN free plan, but I just want to do above things on my server.

  • This sounds like a Cloudflare question? – roaima Nov 18 '15 at 17:01
  • of course not.I just want to ban it on my server.NOT CLOUDFLARE – PotatoChips Nov 18 '15 at 17:04
  • No need to shout. I only asked for clarification. You might be able to get started with cyberciti.biz/faq/block-entier-country-using-iptables – roaima Nov 18 '15 at 17:09
  • Thanks a lot.I'm so sorry.I forget to turn off the upper letters,So lazy I am – PotatoChips Nov 18 '15 at 17:10
  • But I want to allow the banned country to connect to specific port,How should i do? – PotatoChips Nov 18 '15 at 17:12
2

If you are using iptables it will return on the first matching rule. If you want to allow http for example and deny the other ports for China, ensure that the http allow rule comes first:

iptables -A INPUT -d myhost --dport 80 -j ACCEPT
iptables -A INPUT -m set --match-set china src -j DROP

Using the above statements you will need to create an ipset for china using:

ipset create china hash:net
while read line; do ipset add china $line; done < china.ipblock-file
| improve this answer | |
0

If you want to block using Apache module then you can try this also :

MaxMindDBEnable On
MaxMindDBFile DB /path/to/GeoIP/GeoLite2-Country.mmdb
MaxMindDBEnv MM_COUNTRY_CODE DB/country/iso_code

SetEnvIf MM_COUNTRY_CODE ^(CN|RU|DE|FR) BlockCountry
Deny from env=BlockCountry
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.