I have a web site hosted on Azure. I want my web site to be accessed only in US. If someone tries to access my web site from other countries like India, Japan, Russia etc, it should be forbidden. I tried various options like restricting using Azure Firewall but it did not work out. I think IP based restrictions wont solve my problem as in US we have many IP ranges and its difficult to add all the IP ranges. There might be a way of doing it with Conditional Access but we dont have license for it. Pls let me know if there is a way in Azure where I just select allow access for USA.
2 Answers
Exactly your scenario is described in the documentation for Azure Front Door: https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tutorial-geo-filtering
That being said, there are always ways to circumvent those filters as they usually rely on blocking the IP ranges assigned to a certain region or country's ISPs. Users could simply pick a public proxy server located in the US and your site will see an US source IP address. As a countermeasure you could try to detect proxies, for example by looking at some of the HTTP headers they add and block these requests as well but this will also keep legitimate users out.
But in the end, if I really want to see your side and I'm outside the US, I spin up a VM quickly in an Azure US region and access your page from there.
I use the API of a site called AbuseIPDB.com. You get 1000 free IP checks a day for the free tier (enough for us). In C# / Razor code-behind files we capture the IP address and use AbuseIPDB's API to check the IP. They have an "abuse confidence score" which will indicate if people have reported it as an abusive IP. They also return the 2-digit country code. Using this we redirect the traffic to an "invalid login" page if it's outside the US. Works great.
We use the "Check" API endpoint from AbuseIDBP. Here's the link: https://docs.abuseipdb.com/#introduction
I have no financial or other ties to AbuseIDBP. Found them searching SO.
Related