Hi, I have connection attempts from other countries to my network, and I want to be able to tell my mikrotik which countries can connect or pass through it, example, Venezuela, Colombia .. How can I do this?
Thank you
Short answer: you cannot. There is no “I am from Venezuela” identifier in the packets.
Bit more info: you can try to setup an addresslist with the subnets you want to block and manually or automatically keep this uptodate.
Of course it is a battle against the changes in the network and also you may find that your prejudice against those countries is not really warranted.
(i.e. after you have blocked them you discover that there are connection attempts from other countries too, and/or that sometimes you want to have
legitimate connections with the subnets you have blocked)
General advice: don’t go this road. Secure your networks against everyone, not just some countries. Limit the access to your management
interfaces (winbox etc) using your own management network with VPN, for example.
see this thread http://forum.mikrotik.com/t/blocking-ips-by-region/114895/1
Interesting link in that. Not sure where its from and how its produced mind you.
If interested in protection for pennies from a fellow forum person, check out MOAB on a forum search.
The author will answer any questions you may have on blocking and not just by country as that by itself is by no means a solution.
This will only block users that tries to reach the site normally. If a user likes to change source IP, he can use VPN/RDP server ++++
Example download and install Hola Better internet for you Chrome free. You can then set what country you like to be in while surfing.
Remember that since this is a free tool, there are drawback, like you become a node in the net for other to surf trough your computer, so when not using it disable it.
it is not exactly what I was looking for, but it can be used for the same purpose,
so from that link I could generate the ips geographically and create a filter rule,
for the knowledge of others this is the link:
https://mikrotikconfig.com/firewall/
The link has some value for sure, but I would never stick anything on my router from an unnamed or unknown source. Do you know where this is coming from, how often it is updated etc…?
If yes, and you are comfortable with that great. As I stated bad actors are not deterred from such methods as they are well aware of the necessity to appear to come from ‘good countries’. So you are just fooling yourself if you think that one small part of potential solution is going to be that effective… Just my opinion as I have been down this road and just wasted much of my time for very little to zero gain. However, all the work playing with lists and other rules is all good learning stuff for the router.