Recommended Free Tools
Block traffic by country on a Linux VPS by mapping source IP ranges to country codes, then dropping packets whose mapped code is on your deny list. The most direct implementation uses nftables with separate IPv4 and IPv6 maps generated from current country and address CSV files. firewalld can provide the same policy through IP sets and zones or rich rules when it already manages the server.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Country blocking is an IP-range classification system, not a country field carried in each packet. It reduces exposure from selected networks, but it is not an identity control: VPNs, proxies, cloud hosts, mobile networks and stale geolocation data can produce false positives or bypasses.
As an Amazon Associate I earn from qualifying purchases.
What country blocking actually does
A firewall cannot read a reliable country attribute from an incoming packet. Instead, a GeoIP data set lists network ranges and associates each range with a country code. Your firewall compares the packet’s source address with those ranges and applies an action when a match is found.
That means the quality and freshness of the address data determine the result. Allocations change, some addresses are difficult to classify, and users who connect through a VPN, reverse proxy or hosting provider may appear to come from a different country. Treat a country rule as a coarse filtering layer, not as proof of where a person is located.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Choose an implementation path
| Approach | Best fit | How country data is used | Persistence and reload | Main caution |
|---|---|---|---|---|
| Raw nftables | Hosts where you control the native nftables ruleset | Generated IPv4 and IPv6 maps are included in a filter table; source addresses set a packet mark that is matched against blocked country marks | Managed in the host’s nftables configuration and loaded with the distribution’s nftables service | Generated map names and country constants must match the files produced for your data set |
| firewalld with IP sets | Distributions where firewalld already owns firewall policy | Country ranges are loaded into IPv4 and IPv6 IP sets and referenced by a zone or rich rule | Keep both runtime and permanent configuration in sync | Mixing direct rules with firewalld’s nftables backend can produce unexpected precedence |
| firewalld direct rules | Only when a requirement cannot be expressed with zones, sources, IP sets or rich rules | Rules are injected directly into the backend ruleset | Stored through firewalld’s direct-rule configuration | Rich rules are preferred when they can express the policy; direct ACCEPT actions are not always final with an nftables backend |
Current firewalld installations use the nftables backend by default. Its documentation lists “nftables” as the default and says the iptables backend is deprecated and will be removed in a future release. Avoid designing a new country-blocking policy around legacy iptables behavior.
Prepare the VPS before changing packet filtering
- Confirm out-of-band access. Open your provider’s serial, web or rescue console and verify that you can log in without relying on the network path you are about to restrict.
- Record the current ruleset. Save the output of
nft list rulesetand, if firewalld is active, record its zones, sources, IP sets and runtime state. Keep the copy outside the VPS as well. - Identify management addresses. List every administrator IPv4 and IPv6 address, VPN egress address and trusted management network. A dynamic residential address may change, so do not assume one allow-list entry remains valid indefinitely.
- Decide the scope. Start with one service or test port. Blocking all inbound traffic from a country can also affect monitoring, webhooks, game matchmaking, payment callbacks and administrative tools.
- Check both address families. A rule that covers only IPv4 leaves an IPv6 path open when the service listens on IPv6. The documented generator creates separate IPv4 and IPv6 maps.
Build country maps for nftables
Obtain and refresh the input data
The documented nft_geoip.py workflow consumes two CSV inputs: a location file that defines country information and an address file that maps network ranges to locations. Obtain the generator and both current CSV files from the data source you have selected. Follow the generator’s own help output for option names, because distributions and revisions may package it differently.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Run the generator in a working directory and inspect its output. A successful run produces country definitions plus separate files named geoip-ipv4.nft and geoip-ipv6.nft. Do not copy only the IPv4 file into production; the two families are independent.
Review the generated content
Open the generated files before loading them. Confirm that:
- Both address families contain maps and entries for the countries you expect.
- The country definitions use the symbols or numeric marks referenced by the ruleset.
- The files are syntactically complete and do not contain an empty or truncated map.
- The source data’s date and provenance are recorded so you can reproduce or roll back a change.
Include the maps in a filter table
The exact include paths differ by distribution. Conceptually, the ruleset includes the country definitions first, then the IPv4 and IPv6 maps:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
include "geoip-definitions.nft"
include "geoip-ipv4.nft"
include "geoip-ipv6.nft"Use the actual filenames emitted by your generator. If the generated files define a table or map with a different name, keep the names consistent rather than renaming one file by hand.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Write the nftables policy
Set a deliberate chain policy
Attach an input chain to the filter hook and choose an explicit default policy. A temporary test policy of accept lets you verify matching without locking yourself out; a production policy should reflect the rest of your host firewall design. Country blocking should be an additional decision in that design, not a replacement for state tracking, service restrictions or administrator allow-lists.
Allow management before country drops
Place established-session handling and your administrator allow-list before the country decision. For example, an existing SSH session should not be the only path you have when testing a new rule, and a trusted management network should be accepted before any country mark is dropped.
Mark addresses from both maps
The documented nftables examples use these address-family operations:
meta mark set ip saddr map @geoip4
meta mark set ip6 saddr map @geoip6The first operation looks up an IPv4 source address in the generated IPv4 map; the second does the equivalent for IPv6. Keep both statements in the input path. An IPv4 lookup does not classify an IPv6 packet, and vice versa.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Drop the selected country marks
The generated country-definition file supplies the values used as marks. Match the symbols or numeric values exactly as they appear in that file, then drop only the countries on your deny list. A conceptual chain is:
chain input {
type filter hook input priority filter; policy accept;
iifname "lo" accept
ct state established,related accept
# Put administrator IPv4/IPv6 allow-list rules here.
meta mark set ip saddr map @geoip4
meta mark set ip6 saddr map @geoip6
# Replace these generated country symbols with your deny list.
meta mark { COUNTRY_ONE, COUNTRY_TWO } counter drop
}The country symbols in this example are illustrative; use the definitions generated for your data set. If you need to block only one service, put the country match after a protocol and destination-port test instead of dropping every packet from the selected countries.
Load and test safely
- Run a syntax check using the nftables validation mode available on your distribution before replacing the live ruleset.
- Load the rules while your existing management session remains open.
- From a permitted address, verify the service you are protecting. From a test network that geolocates to a blocked country, verify that the intended service is rejected.
- Only after those checks should you persist the rules through your distribution’s nftables service.
Do not close the original console or SSH session until a second session has authenticated and the required services remain reachable.
Implement the same policy with firewalld
Use IP sets for country ranges
firewalld sources can be an IP address, a network, a MAC address or an IP set referenced with the ipset: prefix. Create one set for IPv4 ranges and another for IPv6 ranges when your firewalld version supports both families. Load the generated network entries into the appropriate set; a country list can contain many thousands of networks, so generate the add-entry commands rather than typing them manually.
Free tools Windows power users keep installed
One-click scans. No signup required.
A representative workflow is:
- Create an IPv4 IP set and an IPv6 IP set with names that identify the data date and family.
- Populate each set with the ranges from the corresponding generated map.
- Reference the set as a source for a dedicated zone or in a rich rule that drops traffic.
- Apply the configuration at runtime first, test it, then repeat the approved changes with the permanent option.
Keep runtime and permanent configurations aligned. A runtime-only change disappears on reload or reboot; a permanent-only change does not affect current packets until firewalld reloads or the relevant operation is applied.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Limit the rule to a service when appropriate
If the objective is to protect an SSH daemon, game server or administration panel, attach the IP-set source to a rule that targets that service or port. A broad zone-level source drop is appropriate only when every service on the VPS should reject the selected countries. Apply the narrowest scope that meets the threat model.
Understand backend and precedence behavior
When firewalld uses its nftables backend, direct rules and the generated nftables ruleset are not interchangeable. firewalld documentation warns that a direct-rule ACCEPT does not necessarily terminate evaluation immediately; packets may still be evaluated by firewalld’s nftables rules. A direct-rule DROP, however, is immediately dropped regardless of backend. Prefer zones, sources, IP sets and rich rules when they express the requirement, and reserve direct rules for cases those abstractions cannot represent.
Testing, counters and logs
Verify which rule matched
Add counters to the country-drop rule and inspect them after controlled test traffic. A counter that remains at zero can indicate an incorrect map include, an address-family mismatch, an earlier accept rule or a client whose address is not in the data set.
Use targeted logging
nftables supports rule-level logging. Add a distinctive prefix and a rate limit while testing so a scan or attack does not fill the system log. Full nftables logging support requires Linux kernel 3.17 or newer. Remove or reduce verbose logging after validation; counters are usually sufficient for ongoing monitoring.
Test the paths users actually take
- Test IPv4 and IPv6 separately.
- Test a new connection and an already-established connection.
- Test the exact TCP or UDP ports used by the service.
- Test from a network that is expected to be allowed and one that is expected to be blocked.
- Check local monitoring, reverse proxies, health checks and webhook providers, which may originate in data centers classified outside your intended user country.
Rollback and recovery
Keep a known-good ruleset and a console command ready before activation. If the new policy blocks administration, use the provider console to load the saved ruleset or flush only the new table and chain rather than dismantling unrelated firewall policy. With firewalld, remove the new source or rich-rule configuration from both runtime and permanent state, then reload and verify the active zones.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
When replacing large generated maps, build and validate the new files beside the active files. Switch to the new includes only after syntax and content checks pass. This avoids leaving a half-written map in the live ruleset if a download or generation step is interrupted.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMaintenance and data quality
There is no universal refresh interval for country allocations. Regenerate the maps according to the update cadence of the address data you use, and record the data version with each deployment. A scheduled job can download the new CSVs, generate maps in a staging directory, validate them, and then perform an atomic ruleset reload during a maintenance window.
- Keep the previous map files for immediate rollback.
- Review changes that affect your own administrators, monitoring providers and game-service users before activation.
- Watch counters for sudden jumps or a complete absence of matches.
- Re-test IPv6 after every data refresh.
- Document the blocked country list, the services covered and the exception process for legitimate users.
Common failure modes
Only IPv4 is blocked
Symptoms include successful connections over an AAAA record or an IPv6 literal while IPv4 tests fail. Fix this by generating, including and marking with the IPv6 map and by testing from an IPv6-capable network.
The administrator is locked out
This happens when the allow-list is missing, placed after the drop, or based on an address that changed. Restore the saved ruleset through the out-of-band console, then add stable management addresses before reapplying the country policy.
Rules load but counters stay at zero
Check that the map include is loaded into the active table, that the source address is in the map, and that an earlier rule is not accepting the packet. Verify whether the client is reaching a proxy or load balancer whose address belongs to a different country.
firewalld changes disappear
A runtime-only change vanishes after reload or reboot. Repeat the approved operation with firewalld’s permanent configuration and reload deliberately, then inspect the active rules.
Direct ACCEPT appears to be ignored
With an nftables-backed firewalld setup, direct ACCEPT actions may not end evaluation. Replace the direct rule with a zone, IP-set source or rich rule when possible, or place an intentional DROP where immediate rejection is required.
When country blocking is the wrong control
Do not rely on geography when the real requirement is account security, abuse prevention or access for a known team. Use service authentication, SSH keys, application authorization, connection limits and intrusion monitoring for those goals. Country rules are most useful as a coarse reduction in unsolicited traffic, applied narrowly and combined with normal host-hardening practices.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
