Web Hosting Talk : Web Hosting Main Forums : VPS Hosting : VPS Tutorials : How to Block certain countries from accessing your web site on WHM

[Ruchirablog]

If you want to block certain countries from accessing your web site, there are many workarounds. The most popular and worst method is blocking by IP ranges. But this isn’t a effective solution because of the IP range allocations changes day by day and its almost impossible to find IP range data base of a big country for example like China. And even if you did that, it will slow down your server drastically because even the ranges are too high and iptables software on your server will have to crosscheck every users IP addresses from the blocked range database resulting in slow response times and increased server load.

Config Server Firewall ( CSF ) firewall is a most feature rich software firewall available for linux and it integrates with WHM ( Web Host Manager Cpanel) very easily, enabling loads of configurable options at your disposal. Installing this is very easy when compared to options it has and this provides GUI to control the options on WHM

In my case I wanted to block China from accessing a web site because we were receiving fairly large amount of SPAM registrations from Chinese IPs and our web site had no use for Chinese users as well. So in this guide I’ll explain how I blocked China ( same method goes for other countries/multiple countries as well ) from accessing our web site.

• Requirements

Cpanel WHM access is required. So you will have to be administrator of your server to have access to this

• Features

CSF firewall uses Maxmind geoIP data base to find the IP ranges to block, that’s the most well maintained database of IP ranges on internet. You can trust this because there is no other service available better than this.

• Constraints

Adding multiple countries will slow down your server if you don’t have enough resources and if your site is really busy

• Install CSF Firewall

Installing CSF firewall is extremely easy, just run these commands one by one on your SSH console

    wget http://www.configserver.com/free/csf.tgz
    tar -xzf csf.tgz
    cd csf
    sh install.sh

And that’s it. Installation is done, Now restart your server. Or just restart all the services from WHM.

To open the csf firewall control panel, log in to WHM and on the left side bar you will see “ConfigServer security & Firewall ” at the bottom and click on that.



After that you will be presented a control panel of CSF like this



csf firewall on cpanel How to Block certain countries from accessing your web site on WHM



To block countries, we need to edit the Firewall configuration and to do that click the “Firewall Configuration” button on that control panel.
Add Country/Countries to block list

After you click that “Firewall Configuration” button you will be taken to a place which will show many options in text format and we need to find the ” SECTION:Country Code Lists and Settings” on that page. Its there after you scroll for about 30% of the page.

Or just click Edit – > Find on your web browser and search for “Country” term and you will be able to easily find that section.





csf country block How to Block certain countries from accessing your web site on WHM

On that you can see a box saying ” CC_DENY = ” like shown on the screencap above.

So to add countries to block list, you just need to add the 2 letter code of the countries to that box. In my Example I have added “CN” for China. So if you need to add multiple countries like USA , Germany and China just enter “CN,US,GB” on that box.



After adding scroll to the bottom of the page and click “change” button to save the changes. And restart the services using WHM.


Thats it!

I have originally published this on my blog here
http://www.ruchirablog.com/block-cer...b-site-on-whm/

You can find my other guide about installing squid as a ultrafast proxy to browse blocked web sites here.
http://www.webhostingtalk.com/showthread.php?t=1011438

[Farbyte]

Good post, we like CSF
You can also use 'IP Deny Manager' in cPanel to block IP ranges from accessing your website. This uses .htaccess though, so CSF is preferred as it employs iptables, thus completely blocking access to the server from the banned IP/range.

[Acroplex]

Caution though: blocking a country the size of China means a LOT of IP ranges will be parsed. This can take a toll on your server's performance and it's recommended for dedicated servers only.

[regex]

At one stage, I was blocking China, India and Russia through CloudFlare. Within one month, my traffic started to tank, even though very little of the the "real traffic" reported by GA comes from these countries. This makes me wonder if Googlebots in these countries were denied, and if this somehow affected global PageRank.
No longer using CF by the way.

[damoncloudflare]

Originally Posted by regex

At one stage, I was blocking China, India and Russia through CloudFlare. Within one month, my traffic started to tank, even though very little of the the "real traffic" reported by GA comes from these countries. This makes me wonder if Googlebots in these countries were denied, and if this somehow affected global PageRank.
No longer using CF by the way.

We actually have Google's IPs listed in our macro and wouldn't be blocking the Google bots. The only time there is really an issue is if they start crawling from new IPs, which they don't announce, so this would be generally a very temporary problem until we get the new IPs in our macro.

[regex]

This is going to get off-topic, but I have to respond.

We actually have Google's IPs listed in our macro and wouldn't be blocking the Google bots.

I know, in theory CF sounds excellent.
It just didn't work out for me at all. My site was never down without CF, but with CF it was down quite a few times (not just mine but others on the CF forum), which really freaked me out. During the beta everything was fine, but after the release problems started, and I soon left the service. But maybe everything has been fixed now and it is working perfectly. In any case, I won't be going back.

[damoncloudflare]

Originally Posted by regex

This is going to get off-topic, but I have to respond.



I know, in theory CF sounds excellent.
It just didn't work out for me at all. My site was never down without CF, but with CF it was down quite a few times (not just mine but others on the CF forum), which really freaked me out. During the beta everything was fine, but after the release problems started, and I soon left the service. But maybe everything has been fixed now and it is working perfectly. In any case, I won't be going back.

Sorry to hear that. A lot has changed, notably over the past six months or so, and a lot of the issues people faced after the public release are pretty much fixed.