Best way to geo-block on VPN ports
-
I'm using the GeoIP function of PFBNG, but wondering if I'm doing it in the most efficient way.
I noticed a number of rejections hitting my VPN ports. I thought it might be prudent to restrict access to IP addresses to where I may be. As I'm not planning to leave the country in the next 6-months, that meant restricting to US-based IPs.
I setup a rule to drop any connection attempts from an inversion of the North American IP addresses. This seems to work, but I wanted to make sure I'm not creating any unnecessary overheard in either memory or CPU time.
Is this way a good way to go about it?
Thanks for any input/advice!
-
There are many ways to do that… But i would recommend to create a Permit Inbound rules instead. This way your not going to fill the logs will all of the IPs that were blocked hitting that rule… So less noise, means you can review the logs for real events that need attention :)
Its always better to try to limit down the allowed IPs to as small of a range as possible... There are still a lot of IPs in North America... But its still better than leaving it wide open...
