IP Geoblocking Strategy - R81.10 Firewall

[mikegemini]

Hi Everyone,

One of my clients is using an R81.10 Firewall.

They noticed that someone was attempting to connect to the network, using a Russian Federation IP address. That individual looks like they attempted to use IPs from a few different countries, then they eventually switched to one that wasn't on our GeoGraphic block list.

Three Questions: 

1.) Is this an issue with this specific firewall that my client is using in any way, or just part of the evolving landscape with VPNs being used easily?

2.) How prevalent are attackers circumventing IP blocks with VPNs?

3.) If this is prevalent, is doing GEOgraphic blocks of inbound traffic still worth doing? My thought is it might stop an amateur from getting into my client's network at the very least, but that's just my personal bias speaking. 

[PhoneBoy · Accepted solution]

Geo-blocking isn't foolproof.
It's easy for determined hackers to find an IP that's not being geo-filtered through any number of VPN providers. 
Also, the geo databases for which IPs are where in the world are sometimes inaccurate.

My take: unless you're subject to a regulatory requirement to do so, I don't see a lot of value in geo-filtering IP addresses.

[Bob_Zimmerman]

As a counterpoint, I see geo-blocking as a good way to filter out the fully-automated trash attacks. Traffic from countries where you don't do business is rarely legitimate. Analyzing and responding to it is a waste of time. Block it and you cut down a lot of noise so you can focus more on serious threats.

Sure, it won't protect against a determined human, but it gives you a higher chance of noticing that human.

[the_rock]

Excellent point @Bob_Zimmerman 

[PhoneBoy]

This falls under "least privilege" insofar as if you have no reason to be communicating with someone in a particular country...why allow it to begin with?
I can see both sides of this.

[the_rock]

Put it this way...you can literally use ANY service out there, such as nord vpn, hma vpn, whatever and say if someone is in a country you are blocking, they can connect to vpn service in a country thats not blocked and bam, now their traffic is not blocked. I totally get the point @PhoneBoy made.

Andy