Banning a Country in KeyHelp

[Chalipa]

Hi,

I'd like to add Russia to ban list in Keyhelp firewall.

Is there any tutorial/guide on how to ban a country in keyhelp?


Thanks in advance.

[Alexander]

Hello,

out of the box, there is no efficient way to do this, beside manual configurations. Using "ipset" and so on...


For the sake of completeness, you could do the following - Warning that may be highly inefficient and will not automatically update, if the Russian IP space changes:

1) Get a list of Russian IP address masks
2) Within the KeyHelp-Firewall, put a new rule to at first position
2.1) Direction: "Incoming traffic"
2.2) Action: "Deny / Reject"
2.3) Sources: Put your list of IP address masks here.
(the list may be to long for the input field, after saving, check if it was truncated, and may add a second (third, ...) rule to be able to put all address masks there)
3) Apply the rules and check the server load

Like I sad, this may be inefficient, however as i blocked china for testing purpose some year ago, i did not notice any issues.
It depends on how much computing power your server has and how busy he is in general.

[Chalipa]

Hi,

Thank you for answering, if I want to block /24 will this work as well?

https://imgur.com/a/o7u45DL

[Alexander]

Yes, this is a network mask notation, and it will work (like it is indicated in the text above the input field).

[Chalipa]

Do I need to put something in ports as well?

Or leave it as it is (blank)

https://imgur.com/a/bGuPqEt

[Alexander]

It depends what you want to achieve:

1) You can leave it blank and everything (access to SSH, Websites, FTP, Mail, ...) on your server will be blocked for those IP addresses.

2) If you put in a port - for example 22 (= SSH) - than only the services listening on the specified port(s) will be blocked for the IP addresses.
In this example (Port 22), the specified IP addresses will not be able to connect via SSH, but they still can see your websites etc.


To help you out and if you are unsure: You may want to post a screenshot of all firewall rules after you have applied them. So that the community can check whether you have set up your rules correctly, because the order of the rules also matters.