News for hackers. Stuff that matters.

A comment on Blocking China IP Address Blocks.

Re:Blocking China IP Address Blocks by djengineerllc on Saturday February 23, 2013 @09:17PM (#5272442)
I'm using fail2ban on one of our linux servers. I have a bunch of fail2ban reports that I can run that lists all ips being blocked, how they were blocked, etc. A lot of times if we get multiple ips being blocked from china (and elsewhere) on the same subnet, I'll just block the entire subnet.
[ Parent | on HN ]
Re:Blocking China IP Address Blocks by ams6110 on Saturday February 23, 2013 @10:03PM (#5272588)
Yeah I think an approach like fail2ban is generally better than wholesale banning of IP blocks by country. Block the people who show bad behavior, not everyone.

Of course if you KNOW you have no users in e.g. China, no harm in blocking them, but any skilled attacker in China is not going to appear to be in China, from your vantage point.

[ Parent | on HN ]