Blocking China IP Address Blocks
mergy.org
Blocking China IP Address Blocks
1–10 of 44 posts
Re: Blocking China IP Address Blocks
#2I'm using fail2ban on one of our linux servers. I have a bunch of fail2ban reports that I can run that lists all ips being blocked, how they were blocked, etc. A lot of times if we get multiple ips being blocked from china (and elsewhere) on the same subnet, I'll just block the entire subnet.
Re: Blocking China IP Address Blocks
#3The ability to do this (and not just for China) is one of the primary reasons I'm looking at new VPN router possibilities to replace the venerable-but-stable RV042s that we've been using for years at clients.
I just haven't found anything yet with a good combination of price, capabilities and hardware VPN support - doubling the price we're currently paying would be feasible, quadrupling it when replacing functioning equipment is harder to justify to non-technical users.
A worthwhile resource for folks with Windows (and with some useful links for others): http://www.sans.org/windows-security/2011/10/25/windows-fire...
Re: Blocking China IP Address Blocks
#4Many of us have users (actual valid users) who live in and visit China and other countries in the world. So we don't block a IP because we think it is in China.
Use rate limiting and block bad IPs that are brute-forcing services (don't lock accounts) then you'll be able to serve your users while keeping the bad guys out.
Re: Blocking China IP Address Blocks
#5Perhaps this will one day be so widely implemented that the great firewall of China will become obsolete, and the censors' dream will be realized.
Re: Blocking China IP Address Blocks
#6This would backfire. The goal, I suppose, is that the Chinese government go after hackers in China more; but even if this happened on a mass scale, the Chinese government would /love/ for more services to be run domestically. They don't need Google or Facebook, what makes you think they won't survive well without any of our sites?
Re: Blocking China IP Address Blocks
#7I'm waiting for Dalton to complain about the use of the Svbtle theme...It seems to happen to every post that links to somewhere not svbtle that uses it.
Re: Blocking China IP Address Blocks
#8For my personal servers, that only host private information, I have no reason for them to be accessed from China - though login attempts were extremely common.
I created this iptables script and update it when I notice any new patterns of abuse
Re: Blocking China IP Address Blocks
#9I'm using fail2ban on one of our linux servers. I have a bunch of fail2ban reports that I can run that lists all ips being blocked, how they were blocked, etc. A lot of times if we get multiple ips being blocked from china (and elsewhere) on the same subnet, I'll just block the entire subnet.
Yeah I think an approach like fail2ban is generally better than wholesale banning of IP blocks by country. Block the people who show bad behavior, not everyone.
Of course if you KNOW you have no users in e.g. China, no harm in blocking them, but any skilled attacker in China is not going to appear to be in China, from your vantage point.
Re: Blocking China IP Address Blocks
#10If you resort to blocking IP ranges to prevent attacks, you are missing the point of how to properly respond to an attack. Blocking ranges might by an extra layer of security (philosophy of defense in depth), but in addition to that you should analyze how this email user account was compromised.
Weak password was bruteforced? Start enforcing strong passwords.
Email server vulnerability exploited? Patch your server.
Etc.