I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source
property to restrict access to SSH to only the internal network and my home public IP address. Yes, it is not an extremely strong defense, it's just another layer in front of strong mechanisms and most importantly - it helps declutter the logs.
That got me thinking - the server is a mail server that allows users to read their emails over POP3/IMAP and send them using SMTP Submission among other things. These two ports are regularly subjected to automated brute-force attempts. However, since they need to be used by the users from multiple places, I cannot simply whitelist IPs that can access them like I did with the SSH.
I started thinking about alternatives and one came to mind - what if I could restrict these ports to IPs coming from our own country? That would be reasonably permissive and would allow the users to access their emails during business trips/from mobile networks - while still dropping a lot of the scripted brute force attacks.
I'm not asking how I can achieve set this up, but how reliable would such setup be in regard to usability. In other words, I'm afraid of false positives - i.e. legitimate users getting denied access. Are country IP blocks standardised and something I can rely on, or is it common ISPs can distribute IPs locally from other blocks? What about mobile internet providers?