Is it possible to restrict portions of a web site to only allow access based on geographical region using the IP address?

Question

^{Disclaimer - I am not a security expert, so this may just be a dumb question. My security knowledge is focused strictly on development. When it comes to configuration and networking, I know only enough to get me by. I'm trying to change that.}

First, I'm not even sure if this is a good idea or even something worth giving a lot of consideration to. If it's a bad idea, please say so in the answer (or a comment), and give an explanation of why.

We've got a publicly accessible website, and portions of it allow customers to access some sensitive data. We've already followed all of the OWASP guidelines in our applications, we have a Web Application Firewall, and we're already taking every precaution we can think of to lock it down. However, our site is constantly being scanned from sites overseas. China, Germany, North Korea, you name it.

Our business is restricted to a very small geographical area. We operate in three states in the United States. In our shopping cart, we sell items that can only be used at our stores - gift cards, for example. With very few exceptions there is absolutely no reason that anyone in another country would need to have access to this portion of our site. (I can see a soldier wanting to buy gift cards for their families back home, but not much else.)

I'm just curious about whether it would be possible to lock down the portion of the website by restricting IP addresses to IP addresses that come from the United States. To clarify, I know how to set IP restrictions in IIS, but I don't know if there are known ranges that are verifiably from the United States.

I do know about IP spoofing, and anonymizers, and I realize that we may lock out people using such tools, and that it's going to be possible for those outside the US to use such tools to bypass even this. I haven't thought through what that would do to the feasibility.

Answer 1

IF you can map an incoming IP address into a geographical location, then yes you can filter out clients based on their presumed current country. However, this relies on geolocation and its associated databases, which are not necessarily very reliable. Also, whenever someone uses a proxy or VPN or IPv6-to-v4 tunnel, then the IP you see on the server is the IP of the proxy/tunnel exit point, not that of the originating computer.

Conversely, if you restrict access to only US-based IP, then it would suffice to rent a server from a US-based provider, and use that server as proxy, to connect to your server with a "US-based IP" (setting up such a proxy is a matter of a one-line command with any Linux system: ssh -D 5000 theproxyserver). Half-serious attackers will thus not be much deterred by the filter you suggest. This location-based filter will mostly block the non-intelligent automatic attempts from botnets (which try to propagate), and these are the least dangerous of the lot.

Restricting the number of potential customers who can see your Web site does not seem to be, in my opinion, a commercially optimal move. Usually, you do not want to chase customers away.