Do you block traffic from China?

havoc

From reading various things on the intertubes at least some people seem to do this. On the basis that a lot of the traffic is not legit and/or malicious.

Thoughts on this? yay/nay

Also, anybody know a clean way of managing this type of stuff. I know one can download country IP blocks and funnel it into iptables but not sure how to remove/manage

AlwaysSkint

IPSet/CSF is your friend.

tetech

Yes. I download IP ranges from not just China but a bunch of countries and do scorched-earth in iptables.

foxone

No, because i have several chinese people using my server as a Matrix proxy to bypass GFW.

sonic

Yes, I use Cloudflare to block China

uhu

China and Vietnam.

InceptionHosting

I used to, then I stopped, but it looks like china blocked Inception hosting in retaliation anyway so its now like a war that is over because everyone just stopped fighting and no one won.

havoc

@foxone said: No, because i have several chinese people using my server as a Matrix proxy to bypass GFW.

That's pretty cool. Not scared of a 3 letter agency busting down your door because someone did something shady via your box?

@AlwaysSkint said:

IPSet/CSF is your friend.

That looks useful. Bit of googling suggests you can add comments to rules and then delete them again based on that like so:

https://stackoverflow.com/a/19734874

tetech

It is simplest to host some pictures of tanks in Tienanmen Square at the IP.

Neoon

I think its a false sense of security, by blocking china and thinking that makes your server safer.
A lot of malicious which for example tries to bruteforce your ssh or anything else, comes from the hacked vps or shared hosting account close to you.

If you have important applications, just geofence them or firewall as usual.

skorous

@Neoon said: I think its a false sense of security, by blocking china and thinking that makes your server safer.

Operative word being safer. Anytime you eliminate a substantial portion of bad actors you are safer - just not safe. The same way taking an armored car to work while wearing riot gear makes you safer. It just makes no difference when you get home to the suburbs and are murdered by your girlfriend in your sleep.

uhu

@skorous said:
you get home to the suburbs and are murdered by your girlfriend in your sleep.

That keeps happening to me.

WSS

@uhu said:

@skorous said:
you get home to the suburbs and are murdered by your girlfriend in your sleep.

That keeps happening to me.

uHu whats this? stab stab stab stab

uhu

I should have probably learned my lesson after I saw the second one sharpening her nails.

WSS

@uhu said:
I should have probably learned my lesson after I saw the second one sharpening her nails.

Well, now I'm interested.

uhu

The third one went with strangulation.

Amitz

Nekki, is that you?

WSS

@uhu said:
The third one went with strangulation.

So she's a member of the house?

poisson

Condoms are not 100% but better than nothing. Same principle.

yoursunny

I don't block traffic from China. A quarter of my readers are in China, and I have many pages written in Chinese.
I believe in an open and free Internet. Thus, I don't plan to block anyone unless I'm being attacked.

PHP_Backend

I don't care about them trying to hack me, they can try all day long. (If the public-private key system is broken, I am screwed anyway).
But I DO get annoyed by the sheer amount of the chinese bots crawling my site repeatedly and eating most of the resource.
One of my hobby blog site only has 1-2 daily visitor but receives millions of hits from China IP. Sometimes I block them by user-agent but most of the time I just choose to not care.

tetech

@poisson said:
Condoms are not 100% but better than nothing. Same principle.

Especially if your httpd has a one-child policy.

havoc

@uhu said:

@skorous said:
you get home to the suburbs and are murdered by your girlfriend in your sleep.

That keeps happening to me.

Still haven't learned the correct answer to "does this make me look fat"?

AlwaysSkint

@poisson said: Condoms are not 100% but better than nothing

LMFTFY: Safer not better. (Non ass shagging perspective)

@PHP_Backend said: But I DO get annoyed by the sheer amount of the chinese bots crawling my site repeatedly and eating most of the resource.

This.
Each packet received needs to be processed somewhere, whether 'good' or 'bad'.

uhu

@havoc said:

@uhu said:

@skorous said:
you get home to the suburbs and are murdered by your girlfriend in your sleep.

That keeps happening to me.

Still haven't learned the correct answer to "does this make me look fat"?

"We should have an open and honest relationship," she said.
"Your mother talks so much I'm amazed she doesn't starve, but then maybe you share fat genes with her," said I. Hilarity ensued.

foxone

@havoc said:

That's pretty cool. Not scared of a 3 letter agency busting down your door because someone did something shady via your box?

No, all traffic is heavily encrypted. And i do not keep logs.

havoc

@foxone said: No, all traffic is heavily encrypted.

hmm. Very tempted to upgrade my home internet to 1gbps and use this to offset some of the 35 bucks price diff....