The easiest way to deal with the usual suspects is to just block the entire countries network range(s). There really is no reason they should be connecting to your home router anyway, and you lose nothing from blocking them.
replySure their packets will still hit your router, but if they are dropped immediately at least you're not wasting a syn-ack on them.
I, temporarly, banned some ip range.
I didn't find a source for pinpointing countries; though I am interested. Could you point me to some sources which, deterministically, resolve to some countries? To my knowledge you can not reliably identify countries by ip since this would be dependent on DNS servers. Though I am just a application programmer!
replyThanks in advance.
Your router doesn't care about their DNS settings. IP addresses are very easy to tie back to countries. The reason they say it's not reliable is because it's trivial to spoof the country, but even so, a lot of attackers don't even bother. It's sort of like the Nigerian prince scam calls: if you're wise enough to block Russia, you're not worth their time.
replyYour firewall vendor should supply you with country lists, just select the known bad ones and drop their traffic. If you have a consumer grade router, you will probably have to configure the blocklists manually.
Getting it directly from IANA is always the best approach.
replyHere is a "simplified" version in various formats.
Routers got such a thing build in nowadays, just gotta enable it (not the ones from your ISP of course)
replyI have ubiquity UniFi for this reason (amongst others). OpenWRT is a good choice as well. Most home router software is such junk, might as well leave the door open..
replyThis is one reason I don’t mind that I’m behind CGNAT.
replyThat's the only advantage of CGNAT I can think of. :D
reply(You still could get poked from the other users' hosts behind the ISP's NAT, of course.)
I can corroborate visionheight and shadowserver from my firewall logs.
reply