I've read a dozen guides to using iptables, fail2ban and csf. The commonality seems to be:

1) generate a list of IP rangess for the country you want
2) write a bash/python script to run the allow config for each ip range
3) run a deny all for everything else

The guide on https://unix.stackexchange.com/questions/478735/blocking-all-traffic-except-whitelisted-ip-adresses seems to be the most straightforward explanation.

My question is how do I allow/deny traffic for entire countries without having to handle lists of IP addresses?


  • You can automate the process using script and API. Please refer to blog.ip2location.com/knowledge-base/… for one example.
    – Michael C.
    Feb 15, 2023 at 6:34
  • The other answers wrap it nicely, I’ll summarize: “My question is how do I allow/deny traffic for entire countries without having to handle lists of IP addresses?” – Not possible. // If you do handle these lists of IP addresses, I recommend taking a look at ipset.
    – Daniel B
    Feb 15, 2023 at 21:47
  • The shorter way around is to just collect US IP's and whitelist them and drop all other traffic.
    – cybernard
    Feb 16, 2023 at 18:21

3 Answers 3


The short answer is No.

The longer answer is sort of, but not very well.

The link you linked to would seem correct but almosy irrelevant as it does not look at countries.

There are a number of problems to contend with - specifically iptables does not deal with domain names, it deals with IP addresses/subnets. That said I believe their is a geoIP module for it which maintains a mapping of ip space to country you can use. to achieve your goal.

Note that any such blocking is not going to be anything close to perfect.


@davidgo answer is correct and you have to stick with it, however, there is an important consideration that he did not made clear.

It won't be a one time configuration. The GeoIP lists constantly change, companies sell and buy IP blocks one from another, and I believe it happens cross-country too. So the block list would have the need to be maintained. And it would be not easier to maintain than to build. This is why you often see not a GeoIP database, but GeoIP API — to query the current state of the database which is maintained by someone else, and often you pay for it.

And, I beg you to be very careful with this approach. Don't repeat the Joyce Vogelman Taylor vs MaxMind case. This is what meant by "not very well".


You could


  • Find the domain name of Microsoft.com at who.is, where five name servers are shown, then scrape Registrant Contact Information: US from that screen.

However, the country found would not always be reliable for a few reasons.

  • A single domain name often points to multiple servers, not necessarily all in the same country.
  • An ISP for a user might be in one country though the user resides in a different one.
  • A user in one country can use a VPN exiting in another.
  • The data may be redacted.
  • 1
    While this has valuable - and correct - insights, I dont think it is an answer to the OPs question - specifically it only looks at single IPs, not all the IOs spanning a country.
    – davidgo
    Feb 14, 2023 at 0:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .