I use a Meraki firewall and want to block outside attack attempts. Is there a list of countries that are known to be malicious? I want to load them into the system and GEO block them. I know that some legitimate sites have hosting in another country. Can this pose an issue? Any suggestions would be highly appreciated. I want to ensure we have a secure outside perimeter.
Filtering entire countries' IP ranges will significantly cut down on the amount of malicious traffic coming from actors in those countries, but it will almost 100% ENTIRELY block legitimate users from those countries.
Also, while this is a decent approach to cope with automated scans, it does nothing against a human attacker, who will simply VPN their traffic.
IP blocking is best used for time-sensitive operations, like defending against a sudden spike of malicious traffic out of an IP range. Since it can be easily overcome, it's not an actual 'defense'; it's just a roadblock meant to momentarily impede, deter, or annoy.