Fail2ban/iptables - Allow selected countries only

Here is a great walkthrough of some simple SSH security:

http://bodhizazen.net/Tutorials/SSH_security

In your case, of note is the TCP Wrapper section: http://bodhizazen.net/Tutorials/SSH_security#TCP

From what I have read you can just set hosts.deny to:

 ALL: PARANOID

and then add the IP’s of the users you want to allow…

I would be keen to hear other ideas on this as well.

Hello there,

You can also use CSF (ConfigServer Security & Firewall (csf) to block selected countries. If you’re not familiar with CSF or you want to install it on CentOS or Ubuntu droplet check out this mini tutorial:

For CentOS:

https://www.digitalocean.com/community/questions/how-to-install-and-configure-config-server-firewall-csf-on-centos

For Ubuntu:

https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-config-server-firewall-csf-on-ubuntu

You can also use third-party providers like CloudFlare that provider Firewall features that allow blocking single IP addresses or whole IP ranges.

Just enter an IP address, an IP range, or a two-letter country code you wish to block. You can check more here:

https://serverpilot.io/docs/how-to-block-ips-with-cloudflare/

Hope that this helps!