It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
Your approach to security has a number of issues. First, you don't know if someone is actually interested in your thing or not based on the location. They could be visiting China, could still be able to speak English or any other reason. Secondly, the mapping of Location <> IP Address is not as guaranteed as you seem to think. Plenty of IPs get flagged as Chinese while not being in China, and vice-versa is true as well. Just because some 3rd party says a host/client is in a specific location doesn't make that true.
Edit: Seems the commentator I replied to now have added "just personal stuff and a private forum" to their comment which was not there before, so most of my point is moot now, as I assumed at least semi-public content/service, not private.
When I get any number of malicious known attack vectors, I have a process that runs a few services against the IP for geolocation and server info. If it's a known data center, its block is immediately blocked, otherwise just the IP.
For whatever reason, they tend not to get new ips easily, so shutting down the IP will usually buy a few days before they have a new instance on qualys or whatever.
I do know, because my services (except the forum) are for me exclusively. On the forum, I know everyone. None of the members live in China, have relatives in China or travel to China. If they cannot access the forum, they can contact me in another way.
Yes, I know it's not going to get just China and Russia. Yes I know I'm blocking false positives. Yes I know I'm allowing false negatives.
And honestly, I couldn't care less. It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness.
> Your approach to security has a number of issues.
Your examples are a bit of non-sequitur. If I OVERBAN, I'm not decreasing my security. The non-(Chinese hacker) visitor in China can't get in, that's not a security issue. IP's being flagged as Chinese not being in China... can't get in also not a security issue. Vice versa is a bit of a security issue, with which the second layer of my security onion deals.
I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.
Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal.
To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly.
Now for DOS attacks, temporary IP blocks make perfect sense.
As you mentioned, simply ban couldn't help less. But anyway, their servers, their choices. I've no comment on that.
Thousands of brute force login attempts per day gone. The effect is, as you say, small, but it was non 0 and now it is 0, and it's a bunch of noise I don't have to wade through.
> Failed login attempts / brute force attempts seem like the cost of doing business in public.
Yup, and I pay that cost by blocking the source of 98% of them.
> purely like a fear response with no rational basis (or at least a poor understanding of probability / stats)
Thanks, clearly you know me well /s. And honestly, again, I don't feel that I even NEED a rational basis. It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks. If you want to deride me by calling into question my motives, you can do that too for whatever reason YOU want to, but that's on you.
You are free to act under whatever impetus you want and while I did call in to question your motives (implicitly), I never meant that as a derision. I frequently ask myself "why am I doing this?". It usually doesn't hurt to self reflect.
Edit: Something about this kept nagging me. And I think its this:
>It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks.
I see parallels to a sentiment that used to be fairly common in the U.S.:
"It's my store, I'll refuse whomever I feel like refusing for whatever reason I want, thanks"
Laws against that kind of thing are relatively new (1964?). You have a valid reason to block certain users (hacks) but do you really not see a problem extending that to national origin?
The Seattle Public Library is a public service despite not allowing residents of Guangzhou to borrow books.
In any case, physical goods and services are not analogous to digital goods and services. Or are you redoing the the piracy-is-stealing argument??
If you want a special definition of "public service" that means "accessible every human on earth without any exclusions" then that's fine, but telling someone something isn't a public service because you want to use a special definition of the phrase that no one else seems to use is a bit... overly argumentative?
Nailed it!!! I feel the same
I can understand that limiting services is sad, but nobody has a claim either, right?
So offering to some is way better than offering to none because of overwhelming opsec work (which is still secondary to the content). If the vandals show a pattern, it's bad luck if one shows the same. And proxying should be known to those who suffer from the block.
Maybe internet has to let go the mania of offering everything to everybody all the time. Like real life.
Um, they posted information on a public website. It's not private. Even if the site is owned by them, it is publicly available, of their own accord.
But I do also ban, only temporarily. I found that a lot of IPs just stop reappearing/retrying, likely because they blacklist my IP and move on.
getting scanned and probed by peoples' automated tools looking for vulnerabel daemon RCEs has been a log clutter issue for about 25 years or more now. it's part of the background noise of the internet. ever since the days of having your http daemon logs cluttered up with GET DEFAULT.IDA stuff and similar in 2001.
https://www.google.com/search?client=firefox-b-1-d&q=get+def...
put more effort into ensuring that public facing daemons are totally up to date and hardened against external compromise. Or better yet don't have them public facing at all, if you can admin your server via an ssh daemon that only listens on a logical vpn interface or some sort of OOB interface.
Didn't help me all that much.
Most of the abuse and spam leveled at the servers I manage come through $5 DigitalOcean servers being used as relays.
It's the same thing that ruined voice telephony: Make the connection so cheap that it can be abused at scale.
Most of these attacks are harmless and the attacks that you should be worried is the Advanced Persistent Threat (APT) types [2].
Around eight years back I've proposed a system for crowdsourcing in covertly detecting APT similar to the minefields concept being used in war and I still think it's the best way to reliably detect APT including zero-day attacks.
Few months back in HN someone proposed an open source solution for crowdsourcing firewall, IDS and IPS but cannot get the link for now on top of my head at the moment.
[1] Live Threat Map:
https://livethreatmap.radware.com/
[2] Advanced Persistent Trap:
I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them.
Just to be clear, this is in the context of my private servers which host my mailserver as well as my personal website which is not meant for public consumption, but which I need to be publicly available.
But what would that accomplish? Unlike rogue ISPs in other countries, big cloud providers have abuse reporting that actually works.
Or just block all of them outright if they do not need to access your services.
I have had much better luck with US or EU based cloud providers. In particular, I remember DigitalOcean being very responsive.
I recently had contact with AWS about spam sent using SES and found the response times very quick and the replies appropriate (they’ll look into it but cannot report back, what I expected anyway). This particular spam stopped coming, but that could be a coincidence.
Would neither help nor work, as there's TOR and VPNs to access your servers from anywhere in the wirld.