Are country IP address blocks officially standardised and can they be reliably used for access control?

Question

I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the internal network and my home public IP address. Yes, it is not an extremely strong defense, it's just another layer in front of strong mechanisms and most importantly - it helps declutter the logs.

That got me thinking - the server is a mail server that allows users to read their emails over POP3/IMAP and send them using SMTP Submission among other things. These two ports are regularly subjected to automated brute-force attempts. However, since they need to be used by the users from multiple places, I cannot simply whitelist IPs that can access them like I did with the SSH.

I started thinking about alternatives and one came to mind - what if I could restrict these ports to IPs coming from our own country? That would be reasonably permissive and would allow the users to access their emails during business trips/from mobile networks - while still dropping a lot of the scripted brute force attacks.

I'm not asking how I can achieve set this up, but how reliable would such setup be in regard to usability. In other words, I'm afraid of false positives - i.e. legitimate users getting denied access. Are country IP blocks standardised and something I can rely on, or is it common ISPs can distribute IPs locally from other blocks? What about mobile internet providers?

Answer 1

Blocks allocated by an certain RIR (Regional Internet Registry), e.g. ARIN, while being allocated to a North American entity can end up being used in another country, it can e.g. happen for an European branch office of an American company.

You can know which prefixes belong to which RIR, i.e. AFRINIC (Africa), APNIC (Asia and Oceania), ARIN (North America minus Mexico), LACNIC (Latin America) and RIPE NCC (Europe, Middle East, Central Asia). Querying whois you can learn which countries the entities that were allocated the addresses belong to but that won't guarantee that the addresses are actually used in the country or even region they are supposed to. So it's not a reliable indicator.

Answer 2

I don't know if you can determine if an IP address is used in a given country simply by looking at its prefix.

However, ISPs generally sell the geolocation of their IP addresses and there are databases that map IPs to locations in the world.

If you can get access to the data on one such database or use a service that provides access to some data, you could locally map the IP to its approximate location and see if it belongs to your country.

Answer 3

To expand on what others have already mentioned, there are IP location databases for sale and some with API access that can be used for this kind of thing (e.g. ipinfo.io). Cloudflare also provide country detection for free via their web proxy, although you might not be able to use theirs for IMAP/POP3.

From my experience these location databases have reasonably good accuracy for country level (perhaps 80-97% accurate), but relatively poor accuracy for state/city (less than 80%). It's also quite easy for someone to spoof their country by using a VPN. The VPN I use allows me to select from dozens of countries. So this security layer might block 80-90% of unwanted attacks, especially from random bots who will quickly move on, but it won't stop a determined attacker.

Plus, with the poor accuracy you might find the occasional false positive which could frustrate your users, so use with care.