Blocking Traffic by Country on Production Networks

Blocking Traffic by Country on Production Networks
Timothy M. Mullen

When I originally posted to Bugtraq regarding the use of country-by-country sets to control traffic to or from any particular country, I knew that it was not a new idea. However, applying the concept for use with Microsoft's ISA Server was at least a new application for it, and apparently has had some utility for people based on the thousands of downloads that have been made of the free sets from the Hammer of God Web site.

Expand all | Post comment

Blocking Traffic by Country on Production Networks 2008-07-20
Anonymous (1 replies)

Re: Blocking Traffic by Country on Production Networks 2008-07-22
Anonymous (1 replies)

Re: Re: Blocking Traffic by Country on Production Networks 2009-01-05
Anonymous (1 replies)

Re: Re: Re: Blocking Traffic by Country on Production Networks 2009-05-27
Anonymous (1 replies)

Re: Re: Re: Re: Blocking Traffic by Country on Production Networks 2009-11-03
Anonymous

Blocking Traffic by Country on Production Networks 2008-07-30
Anonymous

Blocking Traffic by Country on Production Networks 2008-08-18
Jason Bevis

Blocking Traffic by Country on Production Networks 2008-09-16
Narsi

Blocking Traffic by Country on Production Networks 2008-10-17
IT Dude

Blocking Traffic by Country on Production Networks 2008-10-31
Anonymous (1 replies)

Re: Blocking Traffic by Country on Production Networks 2009-02-27
kurt

My firewall will go out once a week and get updates to assigned networks for countries. I would get about 50 emails a day from my firewall for ssh attacks, people running cgi, etc. I entered only China, North Korea, South Korea, and Russia to be blocked by my firewall (it blocks by country). I now get roughly 2 emails a day at most.

It might not be "PC", but why is it an issue when you're talking about the security of your server?

Excellent article, and something that all server admins should throw political correctness out the window, and take a serious look at.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1900/1285#1285