There are many options and many articles, but

I want some advice for my particular setup from Pros who have more experience than I do.

On my VPS I have tree magento websites.

All websites have the same target countries.

The idea is to block ALL and allow access only from a few countries.

What would you recommend considering my current setup? see pix below

  • should I use plugins for each website?
  • do something in Varnish?
  • block using htaccess?
  • iptables?
  • webmin firewall setup?
  • something else?

also some automation is preferred, I do not want to manually update the country ips every week my vps setup

1 Answer 1


Cloudflare option

If you are using Cloudflare, this is the method I would use.

  1. Enable IP Geolocation in Cloudflare:

    You can enable IP Geolocation to have Cloudflare geolocate visitors to your website and pass the country code to you in ISO 3166-1 Alpha 2 format.

    You will find the IP Geolocation option under the 'Network' section of the dashboard.

    The option for IP geolocation will be found near the bottom of the page

  2. Configure Varnish to read the header & block access:

    Varnish 4:

    if (req.http.CF-IPCountry !~ "US|CA") {
        return (synth(403, "Your country is not allowed access"));

    Varnish 3:

    if (req.http.CF-IPCountry !~ "US|CA") {
        error 403 "Your country is not allowed access";
  • I pointed domains to cloudflare and was able to block countries the way you suggested (cloudflare + varnish). It works! Thanks. The only downside is that webiste response time went from 500ms went to 1 second. Looks like cloudflare free accout has not the fastest DNS.
    – Mark
    Jul 17, 2017 at 21:11
  • Question: what would be your second option to block countries beside cloudflare ? (preferefly free option but could be paid as well) Thanks
    – Mark
    Jul 17, 2017 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.