Need to find a list of IP ranges allocated to a country

to modify htaccess to deny all countries except a few

[Mokita]

I am having difficulty with this, because although I have found a definitive list of IP ranges for this region (APNIC) unfortunately my own ISP uses a range which is not officially included. It belongs to something called a "Portable allocation or portable assignment".

So if (in theory) I live in country ZZ and I place the following code in my .htaccess, I (and everyone else connected to my large nationwide ISP) am barred from accessing files.

<Limit GET POST>
order allow,deny
deny from all
allow from .zx
allow from .zy
allow from .zz
</Limit>

If that is the case, there may well be similar IP ranges allocated to country ZY and ZX who will be unintentionally blocked.

So the only solution I can see, is to spell out all the specific IP ranges pertaining to the allowed countries, but I haven't been able to find them.

[jdMorgan]

You're setting yourself an almost-impossible task using .htaccess (or any self-generated) IP list, if you intend your 'filter' to be comprehensive. That's because:

IP addresses are not assigned by country, they are assigned (or deallocated) on demand, and

The assignments change over time

Given a "chinese" Class A address, for example 210.0.0.0 through 210.255.255.255, you'll find smaller, but not insignificant Class B (65,536 address) ranges, and even Class C (256-address) ranges embedded within that 'chinese' block that are assigned to Australia, New Zealand, India, etc.

So, the problem is that, worst-case, you'd have 16,777,216 lines of code in your .htccess file -- that's 16.7 mllion lines, all of which would have to be processed for each and every page, image, stylesheet, and script requested from your server. You'd also have to maintain that list to keep it accurate. You'd probably still be able to serve 50 to 500 page requests per day, but your site would be awfully slow -- assuming your hosting service didn't shut you down for excessive CPU utlization. The actual number of lines could be as high as 16.7 mllion lines, or as low as only 256 lines, but you can't tell which from year to year, or even month to month. If the IP address blocks become more fragmented, your list gets longer. If address blocks get consolidated over time, your list gets shorter. There's just no way to tell.

And when IPv6 rolls out, that number increases astronomically. IPv6 will support sufficient IP addresses to give each grain of sand and insect on earth its own IP address.

A better approach is to use one of the many "GeoIP" services (do a search) that will provide you with a current database of IP addresses using an optimized database lookup on the IP addresses, rather than a strictly-serial line-by-line compare. If you have httpd configuration file access, this is easily implemented using mod_rewrite's RewriteMap directive. Set up a cron job to download the fresh database to your server, set it and forget it.

Jim

[Mokita]

Thanks for the info Jim, much appreciated. I'll look into GeoIP.