Your business serves customers in three countries. The DDoS attack hitting your network right now originates from 47 countries — 44 of which have never generated a single legitimate request to your servers.
Why are you processing that traffic at all?
GeoIP blocking — also called geographic filtering or country-based blocking — allows you to accept, rate-limit, or drop network traffic based on the geographic origin of the source IP address. It’s not a silver bullet for DDoS mitigation, but when applied correctly, it dramatically reduces your attack surface with virtually zero impact on legitimate users.
How GeoIP Works
Every IP address on the internet is assigned to a specific organization through Regional Internet Registries (RIRs): ARIN (North America), RIPE NCC (Europe/Middle East), APNIC (Asia-Pacific), LACNIC (Latin America), and AFRINIC (Africa). These assignments are public records.
Companies like MaxMind compile these records into databases that map IP address ranges to geographic locations — country, region, city, and sometimes even latitude/longitude. These databases are updated frequently (weekly or daily) and are accurate to the country level approximately 99% of the time.
When a packet arrives at your firewall, the GeoIP database is queried with the source IP address. The lookup returns the country code, and your firewall rule decides what to do: accept, drop, or rate-limit.
The entire lookup takes microseconds. At the XDP layer, where CoreEdge™ operates, GeoIP lookups add negligible latency because the lookup table is loaded directly into the kernel’s memory.
When GeoIP Blocking Makes Sense
Your Business Has a Regional Audience
If your customers are exclusively in the Middle East and you’re receiving a UDP flood from IP ranges registered in Brazil, Russia, and China — there’s no legitimate reason for that traffic to exist. Blocking it is a zero-risk, high-reward decision.
This is the strongest use case for GeoIP blocking: businesses with geographically concentrated customer bases. E-commerce platforms serving a single country, regional gaming servers, local ISPs, government services — all benefit from country-level filtering.
Reducing Attack Surface During Active Incidents
Even if your business serves a global audience, GeoIP blocking becomes valuable during active attacks. If CoreDetection™ identifies that 90% of attack traffic originates from five countries where you have minimal legitimate traffic, temporarily blocking those countries during the attack — and unblocking when it ends — eliminates the bulk of malicious traffic with minimal collateral impact.
Protocol-Specific Geographic Restrictions
You can combine GeoIP with protocol filtering for precision. For example:
- Allow TCP 443 (HTTPS) from all countries — your website is global
- Rate-limit UDP from countries outside your primary markets
- Block ICMP from all countries except your monitoring networks’ locations
- Drop TCP SYN from countries with historically high attack traffic
This layered approach lets you maintain global accessibility for your primary services while restricting protocols that attackers commonly abuse.
Compliance and Regulatory Requirements
Some industries and jurisdictions mandate that network traffic originate from or be restricted to specific geographic regions. Financial services, healthcare, and government networks often implement GeoIP filtering as part of their compliance framework — not just for DDoS mitigation, but for data sovereignty and access control.
When GeoIP Blocking Doesn’t Work
VPNs and Proxies
An attacker in a blocked country can route their traffic through a VPN in a permitted country. GeoIP sees the VPN exit node’s IP address, not the attacker’s actual location. Corporate VPN users, cloud-hosted services, and Tor exit nodes all appear to originate from the country where their infrastructure is located, not the country of the actual user.
Cloud-Hosted Botnets
Modern botnets increasingly run on compromised cloud instances — virtual machines in AWS, Azure, GCP, and other providers. These cloud instances are registered in the provider’s country (typically the US, Ireland, Germany, or Singapore), regardless of who controls them. GeoIP blocking by country would need to block legitimate cloud provider IP ranges, which would also block countless legitimate services.
Spoofed Source Addresses
In volumetric UDP-based attacks (like DNS amplification), the source IP addresses are spoofed — they don’t represent the attacker’s actual location. GeoIP filtering based on these addresses is filtering based on the spoofed identity, not the real origin. It can still be effective if the spoofed addresses happen to be from irrelevant countries, but it’s not addressing the root cause.
Globally Distributed Attacks
Sophisticated attackers distribute their botnet across dozens of countries, ensuring traffic originates from every major region. If attack traffic comes from the same countries as your legitimate users, GeoIP blocking can’t help without causing collateral damage.
GeoIP Blocking Best Practices
Start With Monitoring, Not Blocking
Before enabling any geographic blocks, spend time analyzing where your legitimate traffic actually comes from. CoreTech’s Client Portal provides traffic analytics broken down by source country and ASN. Use this data to build a baseline. You may be surprised — services you thought were domestic-only might have significant traffic from unexpected regions due to CDN nodes, cloud services, or diaspora users.
Use Rate Limiting Instead of Hard Blocks
For countries where you have some legitimate traffic but a high attack risk, apply rate limits instead of outright blocks. A per-source rate limit of 500 PPS from high-risk countries lets your legitimate users through while throttling any flood originating from those regions.
Keep Your GeoIP Database Current
IP address allocations change. Blocks that were registered to one country last year might be transferred or reassigned. CoreEdge™ uses MaxMind’s frequently updated GeoIP database to ensure country mappings remain accurate.
Combine With Other Mitigation Layers
GeoIP is most effective as one layer in a multi-layered defense. Pair it with per-source rate limiting, TCP flag validation, protocol filtering, and behavioral analysis for comprehensive coverage.
How CoreEdge™ Implements GeoIP Filtering
CoreEdge™ supports country-based filtering as a first-class match condition in its firewall rule engine. Every rule you create can include a country_code field that restricts the rule’s scope to traffic from a specific country.
This means you can create nuanced policies:
Rule 1: Accept all TCP traffic from your primary markets (no country filter)
Rule 2: Rate-limit UDP from high-risk countries at 1,000 PPS per source
Rule 3: Drop all ICMP from countries outside your operational regions
Rule 4: Apply strict SYN rate limiting for countries with historically high botnet activity
These rules are processed at the XDP layer — meaning GeoIP lookups and filtering happen at the network card, before packets enter the kernel. There’s no performance penalty, even under terabit-scale attack conditions.
The Client Portal’s real-time traffic analytics show you exactly how much traffic each country generates, making it easy to identify anomalies and adjust your geographic policies. During an active attack, you can see source country distribution in real time and add temporary country blocks with immediate effect.
The Bottom Line
GeoIP blocking won’t stop every DDoS attack. But for businesses with regional audiences, it eliminates a massive percentage of potential attack traffic before any other mitigation technique needs to engage. It’s a force multiplier — reducing the volume that your rate limiters, connection trackers, and behavioral engines need to process.
Think of it as a first filter: coarse, fast, and remarkably effective when your business geography doesn’t match the attacker’s geography.
10-day free trial — configure GeoIP rules, rate limits, and TCP validation through the Client Portal. Defense in depth, from day one.
Want to see this in action?
Get a live demonstration of CoreTech's DDoS mitigation platform.
