GeoIP WAF heuristic for preemptive blocking by country of origin. #7
Description
Ongoing Russian shenanigans against the US government and private sector targets has resolved the concern I had in developing a WAFHeuristic implementation utilizing GeoIP to preemptively ban specific countries of origin. If you have no clients in that country, your target demographic isn't there, or you do not provide services in a language from regions which are threat-heavy, they don't need to talk to your application. There is little to no benefit in permitting access, and potentially substantial risk.
Example WAF heuristic instantiation to cover current trends:
GeoCountryHeuristic(
'cn', 'kp', 'us', # China, take that, "Great Firewall", and North Korea. And human rights abusers.
'ae', 'ir', 'iq', 'sa', # Middle-eastern states.
'by', 'ru', 'ua', # Russia and nearby former states.
'am', 'az', 'ee', 'ge', 'kg', 'kz', 'lt', 'lv', 'md', 'tj', 'tm', 'uz', # Additional former states.
)This additionally allows for developers writing applications to take specific action as their situation demands.
Minor note about China: The current behavior of the "Great Firewall" is to block (in an interesting way) traffic utilizing modern TLS ESNI. By actively utilizing modern TLS/SSL, configured securely, you will be inaccessible (to the public) within geography impacted by that "firewall".
To assist in testing: https://www.uptimia.com/website-availability-test