> Block AWS CIDR ranges ? I do, actually. There is zero reason for anyone to use EC2 instances to contact my personal public machines. > With IPv4 exhaustion

> Block AWS CIDR ranges ? I do, actually. There is zero reason for anyone to use EC2 instances to contact my personal public machines. > With IPv4 exhaustion increasing numbers of people will be using IPv4 allocations across geographic boundaries. And there will continue to be tracking of who is using which blocks, so there should be no reason for error rates to creep up too much. You need to think about the specifics of your situation, not just blindly follow "best practices". For my personal public machines, I do know, with a high degree of specificity, who should be doing what, and from where. I exploit that to place limits on who can talk to them, and it provides a lot of benefit. If you're running a large public service, you're in starting from a very different stance. For my $dayjob, there are good reasons why customers might contact us from a country where we don't yet offer service, so we can't wall them off. But we do occasionally use geoblocking more selectively when we're under attack.