Block visitors from a country on a DirectAdmin server

What is country blocking?

Every visitor has an IP address, like a home address for a computer. Some lists link IP addresses to countries. A firewall is a guard at the server door. It can use these lists to turn away all visitors from a country. This is useful if you get lots of spam or attacks from a place where you have no customers.

This guide needs root access. Root is the main administrator login of the server. It works on VPS and dedicated servers. DirectAdmin has no country block button of its own, so we use CSF. CSF stands for ConfigServer Security and Firewall. It is a free third-party firewall tool. Ask Hostvento support if it is on your server.

The blocking works with the country lists from the free MaxMind GeoIP data. Check the CSF notes about how to get that data, since access rules for it have changed.

Steps

Connect to your server with SSH as root. SSH is a safe way to type commands on a remote server.
Check that CSF is installed.
```
csf -v
```
This prints the CSF version. If it says "command not found", CSF is not installed.

Back up the settings file.

cp /etc/csf/csf.conf /etc/csf/csf.conf.bak

Open the settings file.
```
nano /etc/csf/csf.conf
```
Find the line that starts with CC_DENY. Press Ctrl+W to search.
Put the country codes between the quotes, split by commas. Codes have two letters, like CN,RU.
```
CC_DENY = "CN,RU"
```
This blocks those two countries.
Press Ctrl+O, Enter, then Ctrl+X to save.
Restart CSF.
```
csf -r
```
This loads the new rules.

Allow a country

Use CC_ALLOW if you want to let only chosen countries in. Be careful. This blocks everyone else, even you.

Warning: A wrong country code can lock you out of your own server and sites. Add your own IP to the allow list first with csf -a your.ip.address. Keep the .bak copy.

Country lists are not perfect. People can hide behind a VPN (a service that hides a visitor's real location).

Quick recap

Country blocking turns away visitors by IP location.
DirectAdmin has no button for it, so use a firewall like CSF.
Edit CC_DENY in /etc/csf/csf.conf and run csf -r.
Allow your own IP first and keep a backup.