I have a website that I do not want to be viewed by entire countries. The website is running on a LAMP server. How can I achieve this?
-
7There is nothing more anoying than access denytion becaus you live in a specific country. – Aug 18 '09 at 08:01
-
I also do not recommend it, but it is a requirement of the client – Aug 18 '09 at 08:04
-
Except for getting sued because of sharing content with people not eligible for it :). – Zed Aug 18 '09 at 08:33
-
It is impossible to block access from countries, the internet is not configured that way. You will get many false positives and false negatives. – Jacco Aug 18 '09 at 08:42
-
there are many legal reasons to block countries, for example some countries do not allow online gambling and if you happen to run a gambling site and don't want to get into jail in that country, you might need to block those countries. – rytis Feb 01 '10 at 20:03
-
Jacco - although it is impossible to do it 100% correctly, plenty of companies do it to comply with regulations or contracts. Media sites particularly (Pandora and Netflix to my knowledge, many others surely) do this. – mfinni Feb 01 '10 at 20:05
-
@pulegium A gambling site would need to take credit card information, which would be far, far more reliable than an IP address. – ceejayoz Feb 01 '10 at 20:50
-
@ceejayoz what about a US citizen with EU card?.. What about EU citizen with EU card, but on hols in USA?.. The law says they cannot play... :) – rytis Feb 01 '10 at 21:32
-
@pulegium I said "far more reliable", not "perfect". It's certainly better than IP addresses, especially with how easy proxies in another country are to find. – ceejayoz Feb 01 '10 at 23:32
-
@ceejayoz "reliable" for what? identifying where the card is registered? then yes, geoip can't tell that. but if you want to see where the user is coming from, card issue geographical location is of no use. furthermore, most gambling sites wouldn't even let you register with "illegal" country card... – rytis Feb 02 '10 at 07:43
-
@pulegium The vast majority of credit card holders reside in the same country as the billing address on that card. You can't easily change that with a proxy like you can with an IP address. Registering a card internationally is enough of a pain that it'll weed out all but the most determined folks, who'd get around any measure like this anyways. – ceejayoz Feb 02 '10 at 14:42
-
@ceejayoz yeah i see where you coming from, but try telling that to the lawyers... :) – rytis Feb 02 '10 at 15:49
-
There'll be legal issues with gambling no matter what technical measures are taken to prevent illegal use. If I were coding a gambling site, I'd be sure to be located in a country with no extradition treaties and lax enforcement. Somewhere in the Caribbean? That seems to be where most of these companies are. – ceejayoz Feb 02 '10 at 15:55
6 Answers
Use mod_geoip module. http://www.maxmind.com/app/mod_geoip
For example:
GeoIPEnable On
GeoIPDBFile /path/to/GeoIP.dat
SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry
# ... place more countries here
Deny from env=BlockCountry
You can use rewrite_mod's REMOTE_ADDR condition to redirect banned users to a single page describing the fact that they are not allowed to enter, or simply give them a 403 error.
RewriteCond %{REMOTE_ADDR} ^123\.123\.123\.[0-9]{3}$
RewriteRule .* ...
To get the range of IPs for a country, get the Maxmind database for example.
![](../../users/profiles/15232.webp)
- 241
- 1
- 3
-
+1 for referencing a source, though I don't think using rewrite rules is the way to go, the list might be quite large! – Paul Dixon Aug 18 '09 at 07:58
-
You are absolutely correct. It all depends on how many and what type of countries to block... – Zed Aug 18 '09 at 08:31
Check the IP and determine which country hosts it, and then block it. Of course it's not accurate, but it's something. Generally I'm not a fan of doing this though; but maybe it's required for some legal reason.
You can filter the country ISP's ip adresses. There are a lot of geolocation database, to help you to identify the users country by ip.
![](../../users/profiles/27530.webp)
- 253
- 1
- 8
You can use services like this:
http://www.maxmind.com/app/geolitecountry
to extract info which IP ranges belong to which countries and block them. Keep in mind if you block too many ranges on a high traffic web site you may see some heavy utilisation on your firewalls.
![](../../users/profiles/17361.webp)
- 256
- 1
- 7