Why Geo-Block?
Not every country needs to reach your server. If you run a local business in Brazil, you don't need traffic from North Korea. If you serve customers in the EU, you probably don't need visitors from 150 other countries hitting your login page.
Geo-blocking at the WAF level stops unwanted traffic before it ever reaches your application. No CPU spent. No database queries wasted. No bandwidth consumed.
The Numbers from My Server
After 30 days of logging, I checked where attacks came from:
| Traffic Source | % of Total Requests | % of Attacks |
|---|---|---|
| Target countries (where my customers are) | 23% | 8% |
| Non-target countries | 77% | 92% |
77% of my traffic came from countries I don't serve, and 92% of attacks originated from those countries. Geo-blocking the non-target regions would eliminate the vast majority of malicious traffic with zero impact on real users.
Setting Up Geo-Blocking in SafeLine
Step 1: Go to IP Groups -> Geo Blocking in the dashboard.
Step 2: Choose your approach:
Option A: Allow-list mode (strictest)
Block everything, then whitelist specific countries.
Block: ALL
Allow: United States, Canada, United Kingdom, Germany, France, Netherlands
Option B: Block-list mode (targeted)
Allow everything, then block specific high-noise regions.
Block: Russia, China, Vietnam, North Korea, Iran
Step 3: Apply the rule. Done.
What Happens to Blocked Visitors
Blocked IPs see a 403 Forbidden page. They can't reach your application at all — the WAF drops the connection at the proxy layer. Your app server never sees these requests.
SafeLine logs every geo-blocked request to Attack Logs. You'll see:
- Which country the IP was from
- What URL they tried to access
- The exact timestamp
Which Countries to Block
Based on my 30-day log analysis and common community reports:
Almost always safe to block:
- North Korea — 0 legitimate traffic for 99.9% of sites
- Iran — heavy scanner activity, minimal legitimate traffic (for non-Iranian sites)
High scanner volume, consider blocking if not your market:
- Russia — #1 source of scans on most servers
- China — heavy automated scanning
- Vietnam — growing botnet activity
Block with caution (some legitimate traffic):
- Brazil — high bot activity but also real users
- India — large developer community but also heavy scanning
What NOT to Geo-Block
- CDN IPs — Cloudflare, Fastly, Akamai. These proxy legitimate traffic. SafeLine handles this automatically.
- Search engine crawlers — Googlebot, Bingbot. You want these finding your site. SafeLine's bot detection distinguishes crawlers from attacks.
- Your own office/home IP — obvious, but easy to forget when you add a blanket rule.
FAQ
Can I geo-block at the city or ISP level?
Yes. SafeLine supports country, region, city, and ISP-level filtering through its IP database. For a SaaS product, you might block certain hosting providers (DigitalOcean, Vultr) if they're being used to launch attacks.
Will this affect my SEO?
No. Search engine crawlers (Googlebot, Bingbot) are never blocked by geo-rules. SafeLine identifies them by user agent and verified IP ranges. Your site remains fully crawlable regardless of geo-blocking settings.
What if a legitimate user travels to a blocked country?
They'll need to use a VPN in an allowed country. This is a known trade-off. For most small businesses, the security gain far outweighs the edge case of a traveling customer.
Try SafeLine Community Edition — free, self-hosted, and takes 5 minutes to deploy:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Dashboard: https://<your-server-ip>:9443 | Docs
What countries do you see the most scanner traffic from on your server?
Top comments (0)