> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/products/compute/guides-for-server-management/block-entire-countries-in-the-firewall.md).

# Block entire countries in the firewall

***

Sometimes it’s very useful to block an entire country in the firewall, for example, if you notice that a DDoS attack mainly appears to originate from a country such as China.

In Linux, it is very easy to block an entire country. This is possible because [http://ipdeny.com](http://ipdeny.com/) provides sufficiently good lists of which IP addresses belong to each region of the world. It’s worth noting that the lists are not 100 % accurate, so you may end up blocking more—or less—than you intended.

If you want to see which countries are available, you can check [here](http://www.ipdeny.com/ipblocks/data/countries/) for IPv4 and [here](http://www.ipdeny.com/ipv6/ipaddresses/aggregated/) for IPv6.

There are a few different firewall tools, depending on which Linux distribution (and version) you use. Here, we cover iptables, nftables, and UFW.

{% tabs %}
{% tab title="iptables" %}
{% code title="Command" %}

```
for i in `curl http://www.ipdeny.com/ipblocks/data/countries/cn.zone |awk {'print $1'}` ; do iptables -I INPUT -s $i -j DROP ; done
```

{% endcode %}

The same loop for IPv6 would look like this:

{% code title="Command" %}

```
for i in `curl http://www.ipdeny.com/ipv6/ipaddresses/aggregated/cn-aggregated.zone |awk {'print $1'}` ; do ip6tables -I INPUT -s $i -j DROP ; done
```

{% endcode %}
{% endtab %}

{% tab title="nftables" %}
{% code title="Command" %}

```
for i in `curl http://www.ipdeny.com/ipblocks/data/countries/cn.zone | awk {'print $1'}` ; do nft add rule inet filter input ip saddr $i reject ; done
```

{% endcode %}

And for IPv6 addresses, the command would look like this:

{% code title="Command" %}

```
for i in `curl http://www.ipdeny.com/ipv6/ipaddresses/aggregated/cn-aggregated.zone | awk {'print $1'}` ; do nft add rule inet filter input ip6 saddr $i reject ; done
```

{% endcode %}
{% endtab %}

{% tab title="UFW" %}
Note that UFW isn't as fast as nftables or iptables, so it can take quite some time to block a long list of IP addresses.

{% code title="Command" %}

```
for i in `curl http://www.ipdeny.com/ipblocks/data/countries/cn.zone | awk {'print $1'}` ; do ufw deny from $i to any ; done
```

{% endcode %}

And for IPv6 addresses, the command will be:

```
for i in `curl http://www.ipdeny.com/ipv6/ipaddresses/aggregated/cn-aggregated.zone | awk {'print $1'}` ; do ufw deny from $i to any ; done
```

{% endtab %}
{% endtabs %}

For more information about the different firewall tools, see:

* [Set up a firewall on Debian 9 using iptables](/products/compute/guides-for-server-management/set-up-a-firewall-on-debian-9-using-iptables.md)
* [Set up a firewall on Debian 11 using nftables](/products/compute/guides-for-server-management/set-up-a-firewall-on-debian-11-or-newer-using-nftables.md)
* [Set up a firewall on Ubuntu 22.04 using UFW](/products/compute/guides-for-server-management/set-up-a-firewall-on-ubuntu-22.04-or-newer-using-ufw.md)