you can do this on your SOHO router at home with DDWRT and Optware's asiablock.
http://www.dd-wrt.com/wiki/index.php/Optware%2C_the_Right_Wa...
I've had this setup for years. It's simple and effective. I block China and Russia entirely.
Blocking China IP Address Blocks
21–30 of 44 posts
Re: Blocking China IP Address Blocks
#22If you resort to blocking IP ranges to prevent attacks, you are missing the point of how to properly respond to an attack. Blocking ranges might by an extra layer of security (philosophy of defense in depth), but in addition to that you should analyze how this email user account was compromised. Weak password was bruteforced? Start enforcing strong passwords. Email server vulnerability exploited? Patch your server. E…
Password length and complexity aren't all that critical if it's salted and hashed. Locking out a user after a number of incorrect attempts and then requiring a different password during the reset than the one already used is a better alternative.
Reusing passwords on different sites is a much bigger problem IMO since a lot of places still don't store passwords correctly or don't lock out users after failed attempts.
Re: Blocking China IP Address Blocks
#23I looked at the links in the article and its comments, but this one seemed much more "immediately useful" for me: (and not China-specific either, you can pick any ISO country code to add to your iptables)
http://www.cyberciti.biz/faq/block-entier-country-using-ipta...
If you have a linux-based router, this can be a 5 minute job.
In fact, I'll save you some time. I modified the script slightly to better suit my needs. Enjoy:
#!/bin/bash
# License: any/both of the following: public domain or MIT
#
### Block all traffic from AFGHANISTAN (af) - ISO code ###
#
# you will need to do the following setup steps manually:
#
# iptables -N drop-by-country
#
# for a in INPUT FORWARD OUTPUT
# do iptables -I $a 1 -j drop-by-country
# done
#
ISO="af"
IPT=iptables
WGET=wget
SPAMLIST="drop-by-country"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"
for c in $ISO; do
tDB=$c.zone
#rm -f $tDB
[ -f $tDB ] || $WGET -O $tDB $DLROOT/$c.zone || exit 1
done
# convert IP and mask to decimal IP (32-bit value) (and leave mask unchanged)
BADIPS="`for c in $ISO; do cat $c.zone; done | awk 'BEGIN{FS="."}
{
if ($0 == "" || $0 ~ "/^#/") next;
mask=gensub("^[0-9]*/", "", "", $4)
n=gensub("/[0-9]*$", "", "", $4)
n=(($1*256 + $2)*256 + $3)*256 + n
print n " " mask
}' | sort -n`"
# merge adjacent IP ranges until nothing changes
N=""
limit=20
while [ "$N" != "$BADIPS" ]; do
echo "simplifying `echo \"$BADIPS\" | wc -l` rules"
N="$BADIPS"
BADIPS="`echo \"$N\" | awk 'BEGIN{p1="";p2=""}
{
n1=\$1
n2=\$2
if (p1 != "") {
e=2 ** (32-p2)
if (n2 == p2 && int(p1 / e) % 2 == 0 && int(n1 / e) - int(p1 / e) == 1) {
n1=p1
n2--
} else {
print p1 " " p2
}
}
p1=n1
p2=n2
}
END{ if (p1 != "") print p1 " " p2 }'`"
limit=$(( $limit - 1 ))
[ $limit -eq 0 ] && break
done
# convert back to IP format
echo "$BADIPS" | awk '{
o4=$1
o1=o4 % 256
o4=int(o4 / 256)
o2=o4 % 256
o4=int(o4 / 256)
o3=o4 % 256
o4=int(o4 / 256)
print o4 "." o3 "." o2 "." o1 "/" $2
}' | while read a; do
echo "$IPT -A $SPAMLIST -s $a -j DROP"
$IPT -A $SPAMLIST -s $a -j DROP || exit 1
done
Re: Blocking China IP Address Blocks
#24If you resort to blocking IP ranges to prevent attacks, you are missing the point of how to properly respond to an attack. Blocking ranges might by an extra layer of security (philosophy of defense in depth), but in addition to that you should analyze how this email user account was compromised. Weak password was bruteforced? Start enforcing strong passwords. Email server vulnerability exploited? Patch your server. E…
Requiring strong passwords doesn't help if users enter the same strong password on every site, and one of those sites is compromised in a way that exposes plain text passwords. This has happened many times in the last few years. Personally I use separate passwords for every site that matters, but there's no way to force users to do this.
Re: Blocking China IP Address Blocks
#25If you resort to blocking IP ranges to prevent attacks, you are missing the point of how to properly respond to an attack. Blocking ranges might by an extra layer of security (philosophy of defense in depth), but in addition to that you should analyze how this email user account was compromised. Weak password was bruteforced? Start enforcing strong passwords. Email server vulnerability exploited? Patch your server. E…
Password length and complexity aren't all that critical if it's salted and hashed. Locking out a user after a number of incorrect attempts and then requiring a different password during the reset than the one already used is a better alternative. Reusing passwords on different sites is a much bigger problem IMO since a lot of places still don't store passwords correctly or don't lock out users after failed attempts.
Password length and complexity aren't all that critical if it's salted and hashed.
Unless your users' passwords are something like "password" or their user names. Password length and complexity are important, if overplayed.
Re: Blocking China IP Address Blocks
#26Rather than putting multiple deny rules in a chain, why not use xt_geoip? http://xtables-addons.sourceforge.net/geoip.php
Re: Blocking China IP Address Blocks
#27We were very seriously considering if we should block China from our game servers recently. The reason is massive account compromises of our users. There are 300,000 IPs from China that are just trying public leaked email / password databases against our servers. With so many IPs, any kind of normal per IP limiting just doesn't work. Each IP is only trying 10 or so accounts per day. Blocking China was potentially a v…
I suppose it doesn't matter for your service, but that would tend to automatically block people who use the Tor network.
Re: Blocking China IP Address Blocks
#28I looked at the links in the article and its comments, but this one seemed much more "immediately useful" for me: (and not China-specific either, you can pick any ISO country code to add to your iptables) http://www.cyberciti.biz/faq/block-entier-country-using-ipta... If you have a linux-based router, this can be a 5 minute job. In fact, I'll save you some time. I modified the script slightly to better suit my needs.…
Just wanted to say; thanks for that awesome link.
Re: Blocking China IP Address Blocks
#29Be extremely careful using public IP lists, they're not always up to date. My iPhone was reassigned an IP in the 1.43.0.0 block last year, which used to be issued by a Chinese supplier. Caused havoc with geoIP and locked me out of a number of websites for suddenly changing country.
Re: Blocking China IP Address Blocks
#30Earlier quoted context omitted.
Password length and complexity aren't all that critical if it's salted and hashed. Locking out a user after a number of incorrect attempts and then requiring a different password during the reset than the one already used is a better alternative. Reusing passwords on different sites is a much bigger problem IMO since a lot of places still don't store passwords correctly or don't lock out users after failed attempts.
Password length and complexity aren't all that critical if it's salted and hashed. Unless your users' passwords are something like "password" or their user names. Password length and complexity are important, if overplayed.
Ah yes, well... if they're using 'password' for the password, they've got bigger problems ;)
Passwords that can be guessed in 1-3 tries should be excluded, naturally: password, 12345, 11111 etc... But mixed case, special character stuff is a bit redundant.