Blocking all access by certain IP's and countries

[pubwvj]

I've been getting a lot of huge emails from 61.145.129.100 which is "CHINANET Guangdong province network". 17 to date that I've noticed, many more probably that were gutted by filters. Still, it eats up my SMTP bandwidth. I also noticed a big http access from one single user in the 61.x.x.x (forgot the rest) IP range. Is that also in China? Are all Chinese IP's 61.x.x.x?

Is there any way to block all accesses from all of China. I would love to block all of them for the simple reason that they are burning up my bandwidth with no benefit to me. I would like to block all access, http, smtp (email), ftp, etc. I don't want them to use the bandwidth and succeed at sending messages or doing web access (http) but just get refused.

 

[Alexandre Duran]

I've been getting a lot of huge emails from 61.145.129.100 which is "CHINANET Guangdong province network". 17 to date that I've noticed, many more probably that were gutted by filters. Still, it eats up my SMTP bandwidth. I also noticed a big http access from one single user in the 61.x.x.x (forgot the rest) IP range. Is that also in China? Are all Chinese IP's 61.x.x.x?

Is there any way to block all accesses from all of China. I would love to block all of them for the simple reason that they are burning up my bandwidth with no benefit to me. I would like to block all access, http, smtp (email), ftp, etc. I don't want them to use the bandwidth and succeed at sending messages or doing web access (http) but just get refused.

Block this :

61.4.64.0/20 # China
61.28.0.0/17 # China
61.32.0.0/13 # Korea
61.40.0.0/14 # Korea
61.48.0.0/13 # China
61.72.0.0/13 # Korea
61.80.0.0/13 # Korea
61.96.0.0/12 # Korea
61.128.0.0/10 # China
61.232.0.0/14 # China
61.236.0.0/15 # China
61.240.0.0/14 # China
61.248.0.0/13 # Korea
128.134.0.0/16 # Korea
129.254.0.0/16 # Korea
134.75.0.0/16 # Korea
134.196.0.0/16 # China
137.68.0.0/16 # Korea
141.223.0.0/16 # Korea
143.248.0.0/16 # Korea
147.6.0.0/16 # Korea
147.43.0.0/16 # Korea
147.46.0.0/15 # Korea
150.150.0.0/16 # Korea
150.183.0.0/16 # Korea
150.197.0.0/16 # Korea
152.99.0.0/16 # Korea
152.149.0.0/16 # Korea
154.10.0.0/16 # Korea
155.230.0.0/16 # Korea
156.147.0.0/16 # Korea
157.197.0.0/16 # Korea
158.44.0.0/16 # Korea
159.226.0.0/16 # China
161.122.0.0/16 # Korea
161.207.0.0/16 # China
162.105.0.0/16 # China
163.152.0.0/16 # Korea
163.180.0.0/16 # Korea
163.239.0.0/16 # Korea
164.124.0.0/15 # Korea
165.132.0.0/15 # Korea
165.141.0.0/16 # Korea
165.186.0.0/16 # Korea
165.194.0.0/16 # Korea
165.194.0.0/16 # Korea
165.213.0.0/16 # Korea
165.229.0.0/16 # Korea
165.243.0.0/16 # Korea
165.244.0.0/16 # Korea
165.246.0.0/16 # Korea
166.79.0.0/16 # Korea
166.103.0.0/16 # Korea
166.104.0.0/16 # Korea
166.111.0.0/16 # China
166.125.0.0/16 # Korea
167.139.0.0/16 # China
168.78.0.0/16 # Korea
168.115.0.0/16 # Korea
168.126.0.0/16 # Korea
168.131.0.0/16 # Korea
168.154.0.0/16 # Korea
168.160.0.0/16 # China
168.188.0.0/16 # Korea
168.219.0.0/16 # Korea
168.248.0.0/15 # Korea
169.140.0.0/16 # Korea
192.5.90.0/24 # Korea
192.83.122.0/24 # China
192.100.2.0/24 # Korea
192.104.15.0/24 # Korea
192.124.154.0/24 # China
192.132.15.0/24 # Korea
192.132.247.0/24 # Korea
192.132.248.0/22 # Korea
192.188.170.0/24 # China
192.195.39.0/24 # Korea
192.195.40.0/24 # Korea
192.203.138.0/23 # Korea
192.203.140.0/22 # Korea
192.203.144.0/23 # Korea
192.203.146.0/24 # Korea
192.245.249.0/24 # Korea
192.245.250.0/23 # Korea
192.249.16.0/20 # Korea
198.17.7.0/24 # China
198.97.132.0/24 # China
198.178.187.0/24 # Korea
202.0.110.0/24 # China
202.0.160.0/20 # China
202.0.176.0/22 # China
202.3.77.0/24 # China
202.4.128.0/19 # China
202.4.252.0/22 # China
202.6.95.0/24 # Korea
202.14.88.0/24 # China
202.14.103.0/24 # Korea
202.14.165.0/24 # Korea
202.14.235.0/24 # China
202.14.236.0/23 # China
202.14.238.0/24 # China
202.20.82.0/23 # Korea
202.20.84.0/23 # Korea
202.20.86.0/24 # Korea
202.20.99.0/24 # Korea
202.20.119.0/24 # Korea
202.20.120.0/24 # China
202.20.128.0/17 # Korea
202.21.0.0/21 # Korea
202.22.248.0/21 # China
202.30.0.0/15 # Korea
202.38.0.0/20 # China
202.38.32.0/20 # China
202.38.64.0/18 # China
202.38.128.0/21 # China
202.38.136.0/23 # China
202.38.138.0/24 # China
202.38.140.0/22 # China
202.38.144.0/22 # China
202.38.149.0/24 # China
202.38.150.0/23 # China
202.38.152.0/22 # China
202.38.156.0/24 # China
202.38.158.0/23 # China
202.38.160.0/23 # China
202.38.164.0/22 # China
202.38.168.0/21 # China
202.38.176.0/23 # China
202.38.184.0/21 # China
202.38.192.0/18 # China
202.90.0.0/22 # China
202.90.252.0/22 # China
202.91.0.0/22 # China
202.91.128.0/22 # China
202.92.0.0/22 # China
202.92.252.0/22 # China
202.93.0.0/22 # China
202.93.252.0/22 # China
202.94.0.0/19 # China
202.95.0.0/19 # China
210.12.0.0/15 # China
210.14.64.0/19 # China
210.14.160.0/19 # China
210.14.192.0/18 # China
210.15.0.0/17 # China
210.15.128.0/18 # China
210.21.0.0/16 # China
210.22.0.0/16 # China
210.25.0.0/16 # China
210.26.0.0/15 # China
210.28.0.0/14 # China
210.32.0.0/12 # China
210.51.0.0/16 # China
210.52.0.0/15 # China
210.72.0.0/14 # China
210.76.0.0/15 # China
210.78.0.0/16 # China
210.79.224.0/19 # China
210.80.96.0/19 # Korea
210.82.0.0/15 # China
210.87.128.0/20 # China
210.90.0.0/15 # Korea
210.92.0.0/14 # Korea
210.96.0.0/11 # Korea
210.178.0.0/15 # Korea
210.180.0.0/14 # Korea
210.192.96.0/19 # China
210.204.0.0/14 # Korea
210.211.0.0/20 # China
210.216.0.0/13 # Korea
211.32.0.0/11 # Korea
211.64.0.0/13 # China
211.80.0.0/12 # China
211.96.0.0/13 # China
211.104.0.0/13 # Korea
211.112.0.0/13 # Korea
211.136.0.0/13 # China
211.144.0.0/12 # China
211.160.0.0/13 # China
211.168.0.0/13 # Korea
211.176.0.0/12 # Korea
211.192.0.0/10 # Korea
218.0.0.0/11 # China
218.36.0.0/14 # Korea
218.48.0.0/13 # Korea
218.56.0.0/13 # China
218.64.0.0/11 # China
218.96.0.0/14 # China
218.104.0.0/14 # China
221.136.0.0/15 # China
221.138.0.0/15 # Korea
221.140.0.0/14 # Korea
221.144.0.0/12 # Korea
221.160.0.0/13 # Korea
221.168.0.0/16 # Korea
221.172.0.0/14 # China
221.176.0.0/13 # China
221.192.0.0/15 # China
221.194.0.0/16 # China
221.196.0.0/15 # China
221.198.0.0/16 # China
221.199.0.0/19 # China
221.199.32.0/20 # China
221.199.128.0/18 # China
221.199.192.0/20 # China
221.200.0.0/14 # China
221.204.0.0/15 # China
221.207.0.0/18 # China
221.208.0.0/14 # China
221.212.0.0/16 # China
221.216.0.0/13 # China
221.224.0.0/13 # China
221.232.0.0/14 # China
221.236.0.0/15 # China
221.238.0.0/16 # China
221.239.0.0/16 # China
222.16.0.0/12 # China
222.32.0.0/11 # China
222.64.0.0/13 # China
222.72.0.0/15 # China
222.74.0.0/16 # China
222.76.0.0/14 # China
222.83.0.0/14 # China
222.84.0.0/16 # China
222.85.128.0/17 # China
222.86.0.0/15 # China
222.96.0.0/12 # Korea
222.112.0.0/13 # Korea
222.120.0.0/15 # Korea
222.122.0.0/16 # Korea
222.128.0.0/12 # China
222.160.0.0/15 # China
222.162.0.0/16 # China
222.163.0.0/19 # China

 

[Elliot]

Thanks for the list, that put the end to most of the incoming spam. the bl.spamcop.net RBL and reverse lookup check are getting the rest

 

[pubwvj]

Block this :
61.4.64.0/20 # China
61.28.0.0/17 # China
:

Great, thanks! I checked a bunch and those are indeed China, etc. I put them into my .htaccess file. My understanding is that is just blocking http access. Will it also block smtp (mail) from those places as well? Is there a way to do that? I would rather not waste the processing power and bandwidth on having SA do the blocking but just block them as they attempt to deliver.

 

[pubwvj]

It would be nice if there were an expert mode in CPanel that let one edit things like the .filters, .htaccess, .user_prefs for SpamAssassin, etc so that one could enter a lot of IP #'s at once for blocking, etc. There is off course FTP and the CPanel File Manager. Since there were so many IP's to block I did it by directly editing the .htaccess file. It would be nice to have this as part of the CPanel interface.

The problem with doing that for .filters is the info is stored in two places and many users, myself included, don't have access to the deeper level. My solution is to text edit the .filters file and create an extra entry and then delete it within the CPanel interface. That causes the entries to get stored into the other location too. A bit of a hack and a bother.

Of course, a related problem is that CPanel is so out of date on some things like the SpamAssassin preferences.

 

[Elliot]

just add them to your firewall deny file.

 

[nsusa]

If you have APF and BFD you can block all those from getting to the whole server.

Chris

 

[easyhttp]

I had APF installed, but I had problem with Cpanel license server.

 

[rpmws]

I had APF installed, but I had problem with Cpanel license server.

There is a port you have to open up for that. I forget which one ..but that's important. I wouldn't run with your pants down for long ..get yourself a firewall. APF is as good as any.