Is beneficial to have one process listing multiple ports to block country?

Question

I have two process, one run as user client, another run as user inspector

The web app admin ( process client ) port 8080 The web app customer ( process client ) port 8081

Single app process listing on multiple ports

The client process communicate with inspector process via Unix domain socket, the inspector is only who are allowed to call PolicyKit

Now I want to block area admin and just allowed one country to access via geoip (block port 8080 ipset)

Does matter this approach relation to security, can be do the same without port. Like block by session , url, etc ?

Edit: allowed one country to access is a second option but generally the area admin is just access by single IP or whitelist of range ips.

Answer 1

Geolocation-based access control is a poor approach, because it can obviously be bypassed with a proxy, VPN or hijacked device.

You should instead employ strong authentication for all publicly accessible services. For example, if you already use TLS or DTLS, then both the client and the server can authenticate towards each other with certificates (called mutual TLS). This is far more secure than any country restriction.