As a novice, how do I block everything (guests) by country?

[smallwheels]

The difference between blocking a country by ASN as opposed to a country block though, is VPN's can be used with a country block but VPN's can't be used with an entire country ASN block.

That does sound more than weird and not at all related to reality. Countries and ASNs are completely different entities and decoupled - there is some overlap but you cannot block a country by ASNs. Each given country may have loads of ASNs, so you will have a hard time collecting all of them to block a country. It would not work anyway as ASNs are simply organizational entities: IPs belong to a network and networks are bundled to ASNs that have one single owner (but may however be rented out to many different users). However: His networks and IPs within an ASN may span many countries. Have a look at i.e. ASN9009 (M247 Europe) as an example for a notorious bot ASN completely worth blocking that spans many countries:

https://bgp.he.net/AS9009#_prefixes

Formally, they are in Romania, but a wider part of their IPs are in other countries. Each IP-adress get's assigned an individual country of residence and this is how country blocks work. However: Some of the more dubious ASN owners do deliberately assign wrong country information to at least some of their IPs and networks for a bunch of reasons. Country information is not reliable and as it changes frequently it may also differ depending which database you ask at any given moment in time.

I'v absolutely no idea what you mean with this...

VPN's can be used with a country block but VPN's can't be used with an entire country ASN block

... as it makes no sense at all.

Also best not to block Singapore and just challenge it as a lot of big companies based there.

Many months ago a lot of scrapers moved from data centers in China to data centers in Singapore, probably as a lot of people had started to block China entirely due to the insane amount of trash requests and scraping coming from there. Like many others I've blocked Singapore many months ago as well and had no reason to ever look back. I am not particularly interested in "big companies" with my forum, so why should I care?

 

[Alvin63]

Well I have a list of a few countries entirely blocked because there are only 2 or 3 ASN's in the whole country!

And yes I believe country block doesn't prevent people using VPN's but ASN block does (to reach your site that is).

 

[Alvin63]

For example Cuba - Blocking ASN 27725 is supposed to block the entire country/all networks. Ethiopia, Sri Lanka, Libya likewise - one ASN block, is supposed to block the entire country's network.

I wouldn't block Singapore - most of the verified search engines come from there, Google et all. I have Singapore on a managed challenge in Cloudflare, plus 2 or 3 ASN's blocked (but whitelisting known bots just in case) and I hardly get anything from Singapore now. I also have a member from Singapore so wouldn't want to block them.

As I understand it, the big ASN's to block in Singapore are:
134963 (alibaba cloud centre)
141180 (Huawei)
139341 (Tencent Global routing).

Blocking those ASN's made a big difference. They are all huge data centres and don't affect regular individuals. Even then I still whitelisted Known Bots because personally I don't want to block friendly search engines Google, Bing and Duck Duck Go and more.

Noticeably Tencent's 139341 pops up in the USA as well - global routing centre.

If an entire country network is blocked then VPN's can't be used. Whereas blocking a country without blocking ASN's allows for VPN's to be used.

 

[smallwheels]

For example Cuba - Blocking ASN 27725 is supposed to block the entire country/all networks. Ethiopia, Sri Lanka, Libya likewise - one ASN block, is supposed to block the entire country's network.

Cuba, maybe. All your other examples are not exactly developed, internet addicted countries full of businesses that rely on the internet. How do you know that on ASN blocks the whole country? In countries like that you often have just one single telecommunication company that offers landlines, mobile and internet access, thus also typically just has one ASN as well. Also not the typical countries for data centers and hosting. But there may easily be more ASNs, just that you are not aware of them. Also, any time there may be new/ more ASNs and also ASNs that span more than one country but have a couple of IPs in that country.

If you block one ASN you block - guess what - one ASN. If you block a country you block all IPs within that country including those of future ASNs that may be freshly created or IPs that belong to an ASN that mainly is located in another country. As your "single ASN" is connected to the internet it has to peer with at least another ASN and this happens either within the country or outside the country. In the case of Cuba (which is really a special situation) there is i.e. also the single peer of your ASN27725, ASN11960 which you are obviously not aware of:



Those again peer with three international carriers:



But as all traffic towards Cuba seems to be routed through the tiny /24 of ASN11960 this seems to be the special situation that whoever controls that ASN (in case of Cuba probably the government) can switch of internet for the whole country easily. Not your typical situation.

And yes I believe country block doesn't prevent people using VPN's but ASN block does (to reach your site that is).

If an entire countries network is blocked then VPN's can't be used.

VPN means: From my real location and IP I connect to another location via an encrypted tunnel (the VPN). From this other location (called the exit node) I enter the open internet. If my exit node is in a country that you have blocked I cannot access your forum, independent from where I really am. If my exit node is in a country and network that you haven't blocked I can visit your forum, no matter if my real location is within a country that you have blocked.

Honestly: You seem a little overconfident with your statements. Just like two weeks ago you had absolutely no clue about all these things and were wondering about high visitor numbers on your forum. Only short time later you give advice to others, sounding like you had deep knowledge and years of experience. Kudos to your fast learnings, but you randomly spread out completely false statements full of confidence and your advice may be not just wrong at times but counterproductive and sometimes even outright dangerous at your level of knowledge.

 

[Alvin63]

Ouch! Two and a half weeks intensive experience and trial and error and manually looking up ASN's and seeing results - along with help from others, including yourself It had to be intensive learning with 5000 bots and I'm still learning. It seems I am wrong about the VPN issue regarding ASN blocks, so I stand corrected. If using a VPN from their own country they still couldn't access my site if ASN's are blocked - but if using their VPN to switch to another country they could still access my site.

But if blocking some ASN's (eg the singapore data centre ones) and not big communication centres in a country, it leaves communications networks open for regular users to still access a site. But then still a need for challenging due to residential proxies.

However, blocking those three big data centre ASN's from Singapore (whitelisting known bots) broke the back of it with Singapore for me. And when you do that? ie when Singapore isn't a problem any more - they just reappear in other countries via residential proxies.

 

[smallwheels]

In terms of a VPN - I know it connects to another country, but if for example, all the ASN's in a country are blocked, that also blocks VPN usage no? As regards the site who has blocked the VPN's. A VPN couldn't connect out of a blocked ASN could it?

A VPN tunnels you to another IP that serves as the IP that is visible to websites you visit. This IP may be in another country or your neighbor's house - depends from where the exit node is. You can also use a VPN of your own, i.e. in the simplest example connect via VPN to your private DSL router at home and use this as exit point while you are on holiday in $some far away country, forced to use a shady public internet hotspot.

For blocking only the IP of the exit node counts: If you have blocked the IP, the IP range, the ASN or the country the exit nodes IP belongs to it will be blocked. But then most VPNs offer loads of exit nodes - on the other hand with many VPNs the IPs of their exit nodes are known, so you can often block a certain VPN more or less reliably. Or unblock it: I.e. Apple's privacy relay is kind of a VPN and it's exit IPs are known/published. As many other VPN services they use IPs they don't own, i.e. from Akamai and others. I have blocked the Akamai ASN but let deliberately pass traffic from iCloud/Apple privacy relay despite having blocked the Akamai ASN. I also let pass some other VPNs as well as users that are logged into my forum, even if they come from blocked ASNs or blocked countries. One of the advantages of IP Threat Manager is that it makes those things very easy.

 

[Alvin63]

A VPN tunnels you to another IP that serves as the IP that is visible to websites you visit. This IP may be in another country or your neighbor's house - depends from where the exit node is. You can also use a VPN of your own, i.e. in the simplest example connect via VPN to your private DSL router at home and use this as exit point while you are on holiday in $some far away country, forced to use a shady public internet hotspot.

For blocking only the IP of the exit node counts: If you have blocked the IP, the IP range, the ASN or the country the exit nodes IP belongs to it will be blocked. But then most VPNs offer loads of exit nodes - on the other hand with many VPNs the IPs of their exit nodes are known, so you can often block a certain VPN more or less reliably. Or unblock it: I.e. Apple's privacy relay is kind of a VPN and it's exit IPs are known/published. As many other VPN services they use IPs they don't own, i.e. from Akamai and others. I have blocked the Akamai ASN but let deliberately pass traffic from iCloud/Apple privacy relay despite having blocked the Akamai ASN. I also let pass some other VPNs as well as users that are logged into my forum, even if they come from blocked ASNs or blocked countries. One of the advantages of IP Threat Manager is that it makes those things very easy.

I had edited my post above.

 

[Alvin63]

This is what Cloudflare is doing today - the orange line at the top is the bots caught by Cloudflare - 465,000 ish. It doesn't get everything. A percentage of them are able to solve Challenges and get on the site, but the guest numbers are down to about 350.

This is with botfightmode on, 17 countries blocked (mainly Eastern block, a couple of South American), a lot of ASN's blocked. Cloudflare challenges for specific paths on the site, and a final rule challenging every country in the world except USA, Uk, Canada, and most of Europe (just to avoid regular members having to tick a "I am human" box).

So that's 465,000 who never get as far as the server.

 

[Alvin63]

I'd like to try the IP threat monitor as well to clean up some more - I'm just concerned that the ones getting onto the forum are the ones that can solve challenges - which is why I didn't try Bot Guard.