Blocking by country
Blocking whole countries is a blunt instrument. It can cut attack noise usefully — and it will quietly block real users and customers if you are not careful.
When it genuinely helps
If you serve one region and are drowning in login attempts and scans from elsewhere, dropping traffic from countries you never serve is a cheap way to cut the noise. It is a filter against volume, not a security control — a determined attacker simply comes through somewhere you allow.
The data is approximate
Geolocation maps addresses to countries and is frequently wrong at the edges: VPNs, mobile carriers, cloud providers and freshly reassigned ranges all muddy it. Treat it as probabilistic. It is the inverse problem to how your own addresses geolocate, and shares the same imperfections.
Apply it in the right place
For web traffic, block at the application or reverse proxy where you can show a helpful message and keep an exception list. For heavier filtering, do it at the firewall. Always keep a way for a legitimate blocked user to reach you — and remember a global service rarely wants this at all. For abusive sources specifically, egress and targeted blocks beat a whole-country hammer.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base