Block access from China?

[LunaC]

OK, before anyone jumps down my throat for this question, the content on the site isn't relevant for China (doesn't ship to there) and we've had a huge amount of problems (scrapping, attempts at injection attacks etc.). I wouldn't normally even think of blocking an entire region if it wasn't needed.

With that out of the way, is there any way to block access from China and send them to a (polite) 403 page? I've found the list of IP blocks and, as I'd guessed it's too large to block IP by IP, even blocking by ###.###.###. would be a huge file.

Has anyone else had to do this? Is there a better way that I'm missing?

[jdMorgan]

You could block 'big' ranges, and then add exceptions for smaller ranges within the big ones.

Or, you could block by remote hostname, if the IP address resolves via reverse-DNS to a hostname.

Because IP ranges are doled out a little at a time, there is no IP-address-to-country correspondence, so as you've observed, it's a big list any way you do it.

I'd suggest paying attention to which ISPs or IP blocks are your biggest problem, and addressing those first.

Jim

[LunaC]

OK, I'll go through the last few weeks of logs tomorrow to get started then. Right now I have a rather more urgent problem to deals with again. (It's unrelated so I'll start a fresh thread).

Thanks for your advice.