Block some countries from accessing to my website

rubensdev

Hi guys,

I've never done something like this and I would like to know how can I prevent the access to my ecommerce website from some countries which, unfortunately, we can't ship.

I tried to add in the .htaccess the IP's I got from this website https://www.countryipblocks.net/acl.php, but they are too much and my gut tells me that it's not a good idea to keep all those denies in the .htaccess file.

Need to block North and South America, because we have received many visits from countries of those continents.

It's there an optimal way to do this?

Thanks in advance =)

sean

rubensdev blocking IPs by country (as opposed to blocking a country's IPs directly) with .htaccess requires mod_geoip to be installed and configured in Apache.

We do not use mod_geoip in our managed Apache setup so if you need this you'll need to run your own Apache backend server with mod_geoip installed as a custom application.

I don't have a tested procedure for this but I think it should work something like this:

Create a private Apache PHP-FPM stack configured to serve the app you are using.
Register for an account at maxmind.com (who provide the geo-ip data).
Download the MaxMind GeoIP2 databases from your MaxMind account and upload them to your Apache app's shell user account. I used the GeoLite2 databases because they are free, but if you have a paid account then you can use the full GeoIP2 databases.
SSH to your Apache app's shell user.

Run the following commands to get the mod_geoip Apache module:

cd ~/apps/apache_app
mkdir mod_geoip
cd mod_geoip
wget https://download-ib01.fedoraproject.org/pub/epel/7/x86_64/Packages/m/mod_geoip-1.2.10-1.el7.x86_64.rpm
rpm2cpio mod_geoip-1.2.10-1.el7.x86_64.rpm | cpio -idmv

Add the following to your Apache app's httpd.conf (substituting the shell user name and app name with your own:

LoadModule geoip_module /home/shelluser/apps/apache_app/mod_geoip/usr/lib64/httpd/modules/mod_geoip.so
<IfModule mod_geoip.c>
  GeoIPEnable On
  GeoIPDBFile /home/shelluser/path/to/GeoIP.dat

  Require expr %{GEOIP_COUNTRY_CODE} != 'NA' # For N. America
  Require expr %{GEOIP_COUNTRY_CODE} != 'SA' # For S. America

</IfModule>

Restart your Apache.

Like I said, that's not tested but I think it should work. If not, come back here and post the specific error that you see.

That said, completely blocking entire continents just because you can't ship to them seems a bit extreme. For example, if a person from your allowed country is visiting a blocked country and wants to place an order they won't be able to do so. In my opinion a better approach to this problem is to state the geographic restrictions on your website and make them part of the checkout workflow.