I would like to allow traffic from one country only.

I have seen and read online multiple ways, but most of them are outdated (with Xtables-addons), and the other half show how to blacklist IPs that one dose not like.

However this is a wrong approach, to black list everything one by one. A better approach will be to do a white list so everything beside that white list will be blocked.

I am in France; I want to allow only french clients/users to access the server.

The iptables rule I have inplace is

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination xx.xx.xx.xx:80

just forwarding traffic.

  • You will need a list of all IP addresses that are in your country. These exist, but are buggy; Because the IPv4 addresses are running out, IP addresses are being allocated in a strange way that makes it impossible to be reliable. You will get false positives, and false negatives. (Then there are VPNs, these can be used to get around what ever you do. By blocking traffic by country, you become part of the marketing department of the VPN providers.). – ctrl-alt-delor May 1 at 7:57
  • Apache or Nginx? Please add to the question. Any know framework, like PHP/Magento/Drupal? Answers would be much better with more data. – Rui F Ribeiro May 1 at 8:00
  • no framework. this is before it reach the framework, firewall wise with iptables – teran May 1 at 8:45
  • 2
    Just a side note, be very careful about the legal implications when restricting traffic from other EU countries. Free movement of goods / services has caught out a number of companies this way in the past. – Philip Couling May 1 at 9:38
  • You might have French clients/users who are Internet-connected to points outside your country. Also, do you need to consider Réunion and other départements d'outre-mer? – roaima May 1 at 10:09

I'm not suggesting this is the best option, but if you can't find another that works then you could "roll your own" using a downloadable GeoIP database and the ipset tool.

For example download the Geolite2 database Countries in CSV format. Download and unzip the files:

wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip
unzip GeoLite2-Country-CSV.zip
cd GeoLite2-Country-CSV_20190430

Find the id for France and filter all records for french networks:

grep France GeoLite2-Country-Locations-en.csv

awk -F, '$2 == 3017382 {print $1}' > french_networks.txt

Build an ipset containing french networks called france:

ipset create france hash:net
while read network ; do 
    ipset add france $network; 
done < french_networks.txt

Use the ipset to create an iptables rule which drops anything not from France. Note you might need to add extra rules ensure local networks are not dropped:

iptables -A INPUT -m set ! --match-set france src -j DROP
  • trying to do it but iptables v1.6.1: Set !france doesn't exist. Try `iptables -h' or 'iptables --help' for more information. – teran May 1 at 13:35
  • I'll admit I've not tried using ! before to match IPs not in set. Alternatively you might be able to iptables -A INPUT -m set --match-set 'france' src -j ACCEPT might work, then put a blanket iptables -A INPUT -j DROP rule after it. – Philip Couling May 1 at 13:40
  • the ! should be after set, iptables -A INPUT -m set ! --match-set france src -j DROP however ! one problem happen. when applying ur way, u have no ping to the outside world . tried to ping google nothing :P, after removing the rule, ping started work again. – teran May 1 at 13:52
  • @teran I've edited to correct. This rule will block ALL traffic that isn't with a French IP. If you'd like to allow outgoing connections to communicate elsewhere then you can add a specific rule to allow this. – Philip Couling May 1 at 14:28
  • 1
    actually , it does not work. :s i tried to access my server from outside france and i am still able to reach the server. – teran May 1 at 15:03

You can try csf - it's easy to install, and in csfpost.sh you can set you iptables rules. in csf.conf you have CC_ALLOW_FILTER where you can set FR. Please check web documentation and a word of advice - access to console on server is a good ideea, just in case you lock yourself out hehe.

New contributor
Varga Adrian is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Could you add a link to csf? Is it this? – Stephen Kitt Dec 3 at 10:04
  • mind clarify ur answer ? is that possible to load a list of CIDR into the allowed ip ? if so , that would be great to import a country CIDR and that would be it. – teran 16 hours ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.