Country Restriction Script

[lambdacerro]

Hello,

I've coded a PHP script that restricts the access in my forum to some countrys, it works with an IP to country database and a cookie so it checks every half an hour.

I want to know where is the best place to insert it, I think it could be the same place where vbulltin checks the IP bans, so where does vbulletin check the IP Bans?

Thank you.

[iogames]

Just to remind you, that like every cluster of society, there's just a few bad apples... I don't understand why do you want to do that

[lambdacerro]

Originally Posted by iogames

Just to remind you, that like every cluster of society, there's just a few bad apples... I don't understand why do you want to do that

My community is dedicated to only a region in the world, and this would help me to redirect that people who is not part of my region and spend less bandwidth in my hosting.

[jdelasko]

Originally Posted by iogames

Just to remind you, that like every cluster of society, there's just a few bad apples... I don't understand why do you want to do that

I plan on doing the exact same thing with my site as soon as my hosting company can add GeoIP to the server.

The vast majority of hacking and spamming attempts on my site originate from IP addresses in China, Russia, Korea, Russia, Germany, and a few others. Due to the nature of my site, there is simply no reason to allow IP addresses from those countries access to my site since the likelyhood of a single legitimate user from those countries is near zero.

While in many cases blocking entire countries is illogical, in my particular case it makes perfect sense.

[Opserty]

The lengths some people are prepared to go to reduce spam ceases to amaze me

Regarding the OP, just stick some PHP code to call the script in a Plugin hooked to the Global Start hook and you should be fine.

[valdet]

Could you share your solution to block specific countries to access the website. I am also highly interested in doing this for one of my sites.

[lambdacerro]

Ok, releasing the code and database:

What you need:
A website (duh)
A IP To Country Database (included here)

So the script is like this:

PHP Code:

<?php
// Check if the cookie exists
if( empty($_COOKIE['IsValid']) ) {

    $valid = 'true';

    // Establishing a database connection
    $dbh=mysql_connect("localhost:3306","USER","PASS");
    mysql_select_db("IP_ToCountry_Database");

    // Getting User's IP
    $ip = $_SERVER["REMOTE_ADDR"];

    // Executing main query
    $country_exec = mysql_query("SELECT * FROM iptocountry WHERE ipto >= inet_aton('$ip') AND ipfrom <= inet_aton('$ip')");

    // Fetching the record
    $ccode_fetch=mysql_fetch_assoc($country_exec);

    // Getting the country code from the array
    $pais=$ccode_fetch['country2'];

    // Declaring the Allowed Countries by their CountryCode2
    $allowed = array('US', 'AR', 'UY', 'BR', 'FR');

    // Verifying if the user belongs to any of the allowed countries
    if (!in_array($pais, $allowed)) {
    $valid = 'false';
    }
    // Setting the cookie for a 10 minutes life
    setcookie("IsValid", $valid, time()+600);
    mysql_close($dbh);
    if ( $_COOKIE['IsValid'] == 'false' ) {
    echo "Not allowed country";
    die();
    }
}else{
    if ( $_COOKIE['IsValid'] == 'false' ) {
    echo "Not allowed country";
    die();
    }
}
?>

There you have to set the MySQL Connection and the valid countries array.
You can get the countrycode2 of all the countries from here:
http://en.wikipedia.org/wiki/ISO_3166-1_alpha-2

You can get the IP To Country Table for free at http://ip-to-country.webhosting.info/
But it's in csv, I passed it to sql and attached.

I added this script at init.php, but I don't think init.php is the best place for adding that code.

That's All.

NOW I want to know how to transform this script in a vBulletin plugin, I think the ip to country table can be added to vBulletin database, and in the script use the db=> thing.

Thank you

[jdelasko]

Originally Posted by Opserty

The lengths some people are prepared to go to reduce spam ceases to amaze me

It's not about reducing spam. It's about eliminating unwanted visitors to your site that are there for nothing other than hacking attempts and other malicious things. Most of the hacking attempts on my site originate from .cn .ru .de and a few other domains. If my site is about american baseball, what possible reason can I have for allowing these countries to access my site??? I have yet to see a single hacking attempt originate from a US IP address. Everyone that hasn't been living in a cave knows that blocking IP addresses and email addresses are 2 tactics that are completely useless. Blocking entire countries makes good sense in many cases. If I am not offering some sort of global service, why on earth shouldn't I block entire countries?

--------------- Added [DATE]1197875135[/DATE] at [TIME]1197875135[/TIME] ---------------

Originally Posted by valdet

Could you share your solution to block specific countries to access the website. I am also highly interested in doing this for one of my sites.

As an alternative, you can also check out this site: http://www.maxmind.com/app/geolitecountry

I recently had my hosting company move my site to a new server in preparation for running the GeoIP Apache API. If you are on a dedicated server, things are pretty straightforward. On a shared server, hosting companies get pretty cautious when you ask them to run a new API on that shared server. That's why my hosting comany moved me to a less populated server. Once the Apache API is running on my server, all I will have to do is upload a database file and add a few lines to a .htaccess file and I'm all set... no coding, no vbulleting hacks.... nothing. I won't even have to set up an sql database.

Even if you do block entire countries, you can still allow access from IP addresses that you specify even if they originate from a blocked country.

[lambdacerro]

Originally Posted by jdelasko

As an alternative, you can also check out this site: http://www.maxmind.com/app/geolitecountry

I recently had my hosting company move my site to a new server in preparation for running the GeoIP Apache API. If you are on a dedicated server, things are pretty straightforward. On a shared server, hosting companies get pretty cautious when you ask them to run a new API on that shared server. That's why my hosting comany moved me to a less populated server. Once the Apache API is running on my server, all I will have to do is upload a database file and add a few lines to a .htaccess file and I'm all set... no coding, no vbulleting hacks.... nothing. I won't even have to set up an sql database.

Even if you do block entire countries, you can still allow access from IP addresses that you specify even if they originate from a blocked country.

That's nice, but if you use shared hosting, the best is to use my code.

Btw, do you have any guide to make work that api?

[jdelasko]

Originally Posted by lambdacerro

That's nice, but if you use shared hosting, the best is to use my code.

Btw, do you have any guide to make work that api?

You can read all about it at maxmind.com

I'm sure your code works just fine but I'm not interested in a plugin for vbulletin. GeoIP will block access to anything on my server.... period. Once the GeoIP API is running on my server, all I have to do is add a few lines to a .htaccess file to put it to work. The free version of GeoIP gets the country code to IP address translations from a file that resides on your server. The paid version of GeoIP uses an SQL database to look up the information and it's faster I presume. For now, the free version will work for me.