I looked at the links in the article and its comments, but this one seemed much more "immediately useful" for me: (and not China-specific either, you can pick a

I looked at the links in the article and its comments, but this one seemed much more "immediately useful" for me: (and not China-specific either, you can pick any ISO country code to add to your iptables) http://www.cyberciti.biz/faq/block-entier-country-using-iptables/ http://www.cyberciti.biz/faq/block-entier-country-using-ipta... If you have a linux-based router, this can be a 5 minute job. In fact, I'll save you some time. I modified the script slightly to better suit my needs. Enjoy: #!/bin/bash # License: any/both of the following: public domain or MIT # ### Block all traffic from AFGHANISTAN (af) - ISO code ### # # you will need to do the following setup steps manually: # # iptables -N drop-by-country # # for a in INPUT FORWARD OUTPUT # do iptables -I $a 1 -j drop-by-country # done # ISO="af" IPT=iptables WGET=wget SPAMLIST="drop-by-country" DLROOT="http://www.ipdeny.com/ipblocks/data/countries" for c in $ISO; do tDB=$c.zone #rm -f $tDB [ -f $tDB ] || $WGET -O $tDB $DLROOT/$c.zone || exit 1 done # convert IP and mask to decimal IP (32-bit value) (and leave mask unchanged) BADIPS="`for c in $ISO; do cat $c.zone; done | awk 'BEGIN{FS="."} { if ($0 == "" || $0 ~ "/^#/") next; mask=gensub("^[0-9]*/", "", "", $4) n=gensub("/[0-9]*$", "", "", $4) n=(($1*256 + $2)*256 + $3)*256 + n print n " " mask }' | sort -n`" # merge adjacent IP ranges until nothing changes N="" limit=20 while [ "$N" != "$BADIPS" ]; do echo "simplifying `echo \"$BADIPS\" | wc -l` rules" N="$BADIPS" BADIPS="`echo \"$N\" | awk 'BEGIN{p1="";p2=""} { n1=\$1 n2=\$2 if (p1 != "") { e=2 ** (32-p2) if (n2 == p2 && int(p1 / e) % 2 == 0 && int(n1 / e) - int(p1 / e) == 1) { n1=p1 n2-- } else { print p1 " " p2 } } p1=n1 p2=n2 } END{ if (p1 != "") print p1 " " p2 }'`" limit=$(( $limit - 1 )) [ $limit -eq 0 ] && break done # convert back to IP format echo "$BADIPS" | awk '{ o4=$1 o1=o4 % 256 o4=int(o4 / 256) o2=o4 % 256 o4=int(o4 / 256) o3=o4 % 256 o4=int(o4 / 256) print o4 "." o3 "." o2 "." o1 "/" $2 }' | while read a; do echo "$IPT -A $SPAMLIST -s $a -j DROP" $IPT -A $SPAMLIST -s $a -j DROP || exit 1 done # let me end by just saying that blocking an entire country is the WRONG solution, though it might be considered part of a "layered defense" strategy. On the other hand, if you want to apply this to your home router and play with it, that's a different story.