3 ms·

I put on my firewall a block for incoming traffic for all IPs outside Europe which helped a lot with the quantity of attempts.

• Gunnerhead 3y ago
  Very naive question: can a bad actor just use a VPN to get around this?
  • marcrosoft 3y ago
    Yes
  • flangola7 3y ago
    Not if you also block VPNs
    • bootsmann 3y ago
      Fingerprinting VPNs is quite hard so this isn’t a reliable solution.
      • flangola7 3y ago
        There's plenty of services available that provide reliable VPN and proxy detection. Every large corporation uses them.
• oriettaxx 3y ago
  is it possible? how did you filter? (I've tried 2 years ago: at that time even aws is not able to provide a reliable EU ip list)
  • LaputanMachine 3y ago
    I use this setup [1] on my servers. IPs are mapped to countries using Maxmind's GeoLite2 database. Linux's Tcp Wrappers are configured to block access for all IPs that aren't in my country. A custom fail2ban jail adds all IPs that get blocked by the Tcp Wrappers to the system's firewall. [1]: https://www.axllent.org/docs/ssh-geoip/ https://www.axllent.org/docs/ssh-geoip/
    • oriettaxx 3y ago
      thanks!
    • nubinetwork 3y ago
      People still use TCP wrappers? I thought that went out of style 20 years ago.