Bridge WAF
Bridge CDN →

Blocking IP addresses and countries without blocking customers

IP blocking refuses requests from chosen addresses or ranges, and geo blocking does the same for whole countries. Both are quick to switch on and easy to get wrong, because an address says where traffic comes from, not who sends it. Used narrowly and with an expiry, they help; used broadly, they refuse real people who share an address with someone else.

Section Operations Updated Covers block, allow, geo

Quick facts

Blocklist
Refuse listed addresses or ranges, allow the rest
Allowlist
Allow listed addresses or ranges, refuse the rest
Geo blocking
Refuse or allow by the country an address is registered or located in
Where it is applied
Server configuration, the network in front of the site, or a firewall
Main risk
Shared addresses: one block can refuse a whole office, mobile carrier or VPN

Address blocks are a tool for specific, narrow problems. For broad automation they are the weakest control available.

How to block an IP address

  1. Confirm the address is the source. Check that traffic really comes from it and is not a proxy or CDN address in front of many visitors.
  2. Block as narrowly as possible. A single address before a range, a small range before a whole network.
  3. Apply it at the right layer. In front of the site for floods; in the server or application for a specific path.
  4. Write down why and until when. Every block should have a reason and an expiry date; see exceptions for the same rule applied to allowances.
  5. Watch what it refuses. If the block catches requests you did not expect, narrow it or remove it.

Never block or allow special-purpose ranges by accident: private, loopback and documentation addresses are listed in RFC 6890, and a rule written for one of them can behave unexpectedly behind a proxy.

IP whitelisting: when an allowlist is better

An allowlist, sometimes still called IP whitelisting, refuses everything except the addresses you name. It suits places with a known, short list of users: an administration panel, a staging site, an internal API, a webhook receiver.

It fails where users are many or mobile. Home and mobile addresses change, and a person travelling or working from a café is refused. For those cases, sign-in and a second factor protect the resource better than an address list.

WHICH ADDRESS CONTROL FITS WHICH RESOURCE ALLOWLIST FITS BLOCKLIST FITS NEITHER: USE IDENTITY ADMIN PANEL PARTNER WEBHOOK PUBLIC SIGN-IN WHOLE PUBLIC SITE // the larger and more mobile the audience, the less an address list helps
// four resources, and which address control fits each

Geo blocking: what it does and does not do

Geo blocking refuses requests by country, using a database that maps addresses to locations. It is used to meet legal or licensing limits, and sometimes to cut traffic from places a site has no customers.

It is coarse and leaky. Location databases are not perfect, VPNs move a visitor to another country in a click, and attackers rent addresses wherever they need them. Blocking a country also refuses travellers, expatriates and partners there, and those refusals are silent.

Why address blocks misfire

One address can stand for thousands of people: a company behind one gateway, a mobile carrier sharing addresses between customers, a university, a VPN exit. Blocking it for one person's behaviour refuses all of them.

Addresses also change hands. An address that sent abuse last month may belong to a customer today, which is the limit of IP reputation. If your own address is the one being refused elsewhere, IP blacklist check explains how to find out why.

Questions

How do I block an IP address from my website?

Add the address or range to a deny rule in the server configuration or in the network or firewall in front of the site, as narrowly as possible, with a written reason and an expiry date, and watch what it refuses.

What is IP whitelisting?

IP whitelisting, or allowlisting, permits only listed addresses and refuses the rest. It suits small, fixed groups such as administrators or a partner's servers, not public audiences.

What is geo blocking?

Geo blocking refuses or allows requests by the country an address maps to. It is coarse: location data is imperfect and VPNs move visitors between countries easily.

Is blocking IP addresses effective against bots?

Only against a few fixed sources. Botnets and residential proxies use many changing addresses, so behaviour-based limits work better.