# Geo Block IPs via APF or iptables?

**URL:** <https://forums.interworx.com/t/geo-block-ips-via-apf-or-iptables/13351>\
**Category:** General Discussion\
**Created:** [September 1, 2013, 2:51pm UTC](https://forums.interworx.com/t/geo-block-ips-via-apf-or-iptables/13351 "2013-09-01T14:51:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MachTen](https://forums.interworx.com/letter_avatar_proxy/v4/letter/m/b487fb/32.png) [@MachTen](https://forums.interworx.com/u/MachTen)\
**Post date:** [September 1, 2013, 2:51pm UTC](https://forums.interworx.com/t/geo-block-ips-via-apf-or-iptables/13351/1 "2013-09-01T14:51:36Z")

</div>

New to Interworx and just deployed our first server with it.

I want to be able to apply the following script (or something very close to it) to block unwanted countries from spamming/hacking etc.

```auto
ipset -N geoblock nethash
for IP in $(wget -O ? http://www.ipdeny.com/ipblocks/data/countries/{cn,kr,pk,tw,sg,hk,pe}.zone)
do
ipset -A geoblock $IP
done
 Matching against the IPSet in IPTables:
 iptables -A INPUT -m set ?set geoblock src -j DROP

```

What file would I apply this to? I am not sure what firewall config files Interworx is using so I want to make sure I am applying this to the correct file.

Thank you

---

<div class="post-metadata">

**Author:** ![sysnop](https://forums.interworx.com/letter_avatar_proxy/v4/letter/s/cdc98d/32.png) [@sysnop](https://forums.interworx.com/u/sysnop)\
**Post date:** [September 3, 2013, 7:41am UTC](https://forums.interworx.com/t/geo-block-ips-via-apf-or-iptables/13351/2 "2013-09-03T07:41:52Z")

</div>

> …I am not sure what firewall config files Interworx is using so I want to make sure I am applying this to the correct file.  
> The APF front end in NodeWorx is equivalent to editing:

/etc/apf/conf.apf

The Trusted/Blocked access controls are equivalent to editing:

/etc/apf/allow\_hosts.rules and /etc/apf/deny\_hosts.rules

Add the server’s IP to Trusted and go from there.

Debug Mode is equivalent to DEVM=“1” (on) or DEVM=“0” (off) in the file /etc/apf/conf.apf. Be sure to turn this on when you experiment with APF’s rules.

As a stopgap you can ban country IP blocks, as well as domain names, with Apache’s config file or an .htaccess file. This might be the preferred way, depending on your situation.