Why You Might Want To Block Entire Countries

If you run a homelab, a personal server, or a small self‑hosted environment, you’ve probably noticed that most malicious traffic comes from regions you probably never expect legitimate users from. Automated scanners, botnets, and exploit attempts often originate from the same countries, and they hit your server constantly. Here, we will look into why blocking entire countries can be a practical way to reduce noise and how to do so with UniFi gateways. If you don’t serve users globally, blocking entire countries can dramatically reduce:
  • botnet scanning
  • WordPress/PHP malware probes
  • credential stuffing attempts
  • IoT botnet traffic
  • general noise in your logs
Geo‑blocking isn’t a silver bullet, but it’s a powerful noise‑reduction tool.

When Geo‑Blocking Makes Sense

Geo‑blocking is a good idea if:
  • You only host services for yourself or local users
  • You don’t have customers or visitors from the blocked region
  • You want to reduce attack noise without complex firewall rules
  • You want to stop automated scanners before they reach Nginx
Geo‑blocking is not ideal if:
  • You run a public‑facing service with global users
  • You rely on VPNs that may exit in blocked regions
  • You need accurate analytics from all countries
For homelabs, blocking entire countries is often a smart move.

How UniFi GeoIP Filtering Works

UniFi gateways support GeoIP filtering on:
  • UniFi Dream Machine (UDM, UDM‑Pro, UDM‑SE)
  • UniFi Security Gateway (USG)
  • UniFi Next‑Gen Gateways
GeoIP filtering lets you block or allow traffic based on country of origin. It applies at the gateway level, meaning unwanted traffic never reaches your Nginx reverse proxy or backend services.

How To Enable GeoIP Blocking in UniFi

  1. Open your UniFi Network Controller
  2. Search for Region Blocking
  3. Ensure Region Blocking checkbox is checked
  4. Select the countries you want to block

    5. The countries listed here are based on attack attempts on a server in the homelab
  5. Choose Block
  6. Choose whether you want to block incoming, outgoing or both directions
  7. Apply changes
Your gateway will now silently drop all inbound traffic from those regions.

Should You Block South Korea?

If your logs show repeated attack attempts from South Korean IP ranges and you don’t expect legitimate traffic from there, blocking the entire country is reasonable. It won’t stop targeted attackers using VPNs, but it will:
  • reduce automated scans
  • lower load on your Nginx reverse proxy
  • reduce noise from PHP malware probes
For homelabs, this is often a practical and effective choice.

Advanced Option: Default‑Deny Geo‑Fencing

If you want maximum protection, you can flip the logic:
  • Allow specific countries
  • Block the rest of the world
This is extremely effective for private servers and dramatically reduces attack surface.

Finally

Geo‑blocking won’t stop every attack, but it’s one of the simplest ways to reduce malicious traffic before it reaches your server. Combined with Nginx hardening, rate limiting, and a catch‑all server block, it forms a strong first line of defense for any homelab or self‑hosted environment. Also check out our other guides on Nginx security and hardening your homelab for more tips on keeping your server safe. Nginx hardening