Hi,

We have put a .htaccess file in our signup section to block out certain countries (see file contains below). Now when we use this file it slows down the access of the folder considerably. Is this normal?


*************

AuthName "Country access blocked"
AuthType Basic
<Limit GET POST>
order allow,deny
allow from all
deny from .id
deny from .interpacket.net
deny from .lt
deny from .mk
deny from .my
deny from .ro
deny from .yu
deny from 139.92
deny from 152.158
deny from 161.142
deny from 194.102.130
deny from 194.165
deny from 202.134
deny from 202.145
deny from 202.146
deny from 202.148
deny from 202.149
deny from 202.149
deny from 202.150
deny from 202.150
deny from 202.151
deny from 202.152
deny from 202.152
deny from 202.154
deny from 202.155
deny from 202.155
deny from 202.157
deny from 202.158
deny from 202.160
deny from 202.162
deny from 202.164
deny from 202.168
deny from 202.171
deny from 202.178
deny from 202.180
deny from 202.183
deny from 202.184
deny from 202.185
deny from 202.186
deny from 202.187
deny from 202.188
deny from 202.189
deny from 202.190
deny from 202.4
deny from 202.46
deny from 202.47
deny from 202.57
deny from 202.57
deny from 202.93
deny from 202.95
deny from 207.192.198
deny from 210.14
deny from 210.16
deny from 210.186
deny from 210.19
deny from 210.56
deny from 212.138
deny from 212.19
deny from 212.50
deny from 212.59
deny from 213.169
deny from 213.240
deny from 216.3.242.10
deny from 217.9
deny from 62.220.194
deny from 64.110
deny from 64.49
</Limit>

I would expect so. Why not just set up a firewall, instead of making apache do it?

This would not slow it down?

Could you give more advice? It is to prevent fraud.

Thanks

I notice a slowdown on my .htaccess limited folders.

I would suggest bitserve's suggestion, use a firewall.

I think ipchains could handle what you want to do. Of course there will be cpu overhead when you need to check all those IPs, but I think ipchains could handle it far better than apache can.

I have no idea if this will make a difference, but something I would try is removing those country codes (like .id) and going exclusively with IP number. It could be that the host lookup is what's causing the slowdown (but don't quote me on that). Doesn't hurt to try.

Chris,

You are right. By removing the following:

deny from .id
deny from .interpacket.net
deny from .lt
deny from .mk
deny from .my
deny from .ro
deny from .yu


there is no slowdown anymore.

Now perhaps trying to identify the IP's for those countries, although I think they are shared with the rest of Europe.