Geo-blocking

Cut your attack surface by an entire continent.

Block the countries the flood comes from, or allow only the ones your players are in. PAKKT pushes up-to-date CIDR ranges into nftables sets, in both IPv4 and IPv6, with an anti-self-block guard that always protects your access.

Configure a country policy See XDP / nftables rules
v4 + v6
two families
weekly
CIDR refresh
anti
self-block
app.pakkt.io/protection · country blocking ● LIVE
Two approaches

Block a list, or allow only a list.

Block mode

Everything passes, except these countries

You list the countries to block. Good for cutting off recurring attack origins while staying open to the rest of the world. Verdict saddr @set drop.

Allow-only mode

Nothing passes, except these countries

You list the only allowed countries. Perfect for a regional service (European game, etc.): the attack surface shrinks to your actual zone. Verdict saddr != @set drop.

Under the hood

nftables sets, delivered up to date.

PAKKT does not perform a GeoIP lookup on the agent: the Core API resolves the CIDR ranges and delivers them already computed. The agent installs them atomically into named sets, updated in a single nftables transaction.

  • ▸Source: ipdeny.com aggregated zones, refreshed every week.
  • ▸Deduplication: ranges are repushed only when they actually change.
  • ▸v4 + v6: country_v4 / country_v6 sets, on input and forward.
  • ▸safe_ips guard: localhost and Core API stay allowed, at the top of the chain.
Chain order (priority)
1safe_ips guard: localhost + Core API
2your explicit IP whitelists / blacklists
3country policy (block / allow_only)
Explicit user intent always comes before the country rule. You cannot lock yourself out.
Keep going

Explore the platform

Real-time monitoring Live dashboard, GeoIP world map, top IPs and ports. Discover → XDP + nftables rules Two independent kernel layers, one panel. Discover → Auto Shield Automatic attack detection and IP banning. Discover → Proven effectiveness The same attack, with and without PAKKT. Discover →
FAQ

Frequently asked questions

Straight answers, no marketing fog.

How does country blocking work at PAKKT? expand_more
You pick countries (ISO 3166-1 alpha-2 codes) and a mode: "block" (everything except those countries passes) or "allow-only" (only those countries pass). PAKKT resolves each country's CIDR ranges and pushes them to the agent, which installs them in two named nftables sets (IPv4 and IPv6). The verdict applies on the input and forward chains.
Where do the per-country IP ranges come from, and are they up to date? expand_more
The CIDR ranges come from ipdeny.com aggregated zones, refreshed every week. On each update, PAKKT recomputes the ranges and only repushes them to the agent if they have changed (deduplication by fingerprint). So your servers stay current on their own, with nothing to do on your end.
Does country blocking support IPv6? expand_more
Yes. Geo-blocking handles both IPv4 and IPv6: two separate nftables sets (country_v4 and country_v6) are populated, and four rules cover input and forward for each family. Unlike the XDP layer, which stays IPv4 for per-host filtering, the nftables layer handles both families.
Is there a risk of blocking yourself when enabling a country policy? expand_more
No. PAKKT inserts a "safe_ips" guard at the top of the chain, which always allows localhost and the Core API IPs before any country policy. Your explicit IP whitelists also pass before the geographic policy: explicit intent always wins over the country rule. A miscalibrated policy cannot cut off your access to your own agent.
When is country blocking useful? expand_more
A few common cases: a game server whose players are European but takes flood from other continents (allow-only mode), shrinking your attack surface by blocking the countries most attacks come from, or regional compliance constraints. Country blocking works alongside your XDP/nftables rules and Auto Shield. It does not replace them.

Cut off what has no business reaching you.

From 3 € / server / month. Use a preset (EU, North America, top DDoS threats) or build your own list. Free 7-day trial.

Set up my countries See proven effectiveness