What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable way to block a country on a Linux VPS is to classify source IP addresses against current country-to-network data, then drop matching IPv4 and IPv6 packets in your firewall. With nftables, a documented GeoIP generator creates country definitions and separate address maps; the ruleset marks packets from those maps and drops the marks you select. firewalld can provide the same policy through IP sets, zones, and rich rules. Whichever frontend you use, protect your management addresses first, test on a narrow service, and keep out-of-band console access available.
What country blocking actually does
A packet does not carry a trustworthy country field. Geo-blocking is an address-classification problem: a maintained data set maps IPv4 and IPv6 networks to country codes, and the firewall compares each packet’s source address with those networks. The result is only as current as the data used to build the maps.
This policy is useful for reducing exposure from regions you do not serve, limiting automated abuse, or satisfying a documented access policy. It is not an identity control. Mobile carriers, cloud providers, VPNs, proxies, satellite links, and travelers can make a user’s apparent country differ from their actual location. Treat a country drop as a coarse filter and keep authentication, patching, rate limits, and service-specific authorization in place.
IPv4-only rules leave an IPv6 path open when the VPS, DNS, and client all support IPv6. Complete coverage therefore requires separate IPv4 and IPv6 data and rules.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Choose the control plane before changing rules
| Approach | Best fit | How country data is attached | Persistence and reload | Main caution |
|---|---|---|---|---|
| Raw nftables | A host where you want the native packet-filtering ruleset and direct control | Generated IPv4 and IPv6 maps are included in an nftables ruleset; source addresses set a packet mark that is matched in the input chain | Your normal nftables configuration and reload process; validate the complete ruleset before applying it | Map names, generated country marks, include paths, and chain priorities must match the generator output and your distribution |
| firewalld with nftables backend | A distribution already managed with zones, runtime/permanent state, and firewall-cmd | Country networks are loaded into IP sets and referenced with a zone source or rich rule | Use runtime commands for testing, then repeat with --permanent and reload |
Direct rules and rich rules can have surprising precedence; do not mix backends casually |
| firewalld with iptables backend | Only where an existing, tested legacy deployment requires it | IP sets and firewalld policy still provide the abstraction | Managed by firewalld’s runtime/permanent configuration | firewalld documents the iptables backend as deprecated and says it will be removed in a future release |
firewalld documentation states: “Possible values are; nftables (default), or iptables.” It also states: “The iptables backend is deprecated. It will be removed in a future release.” On a new deployment, prefer the nftables backend unless your operating system’s support policy gives you a specific reason not to.
How the nftables GeoIP method works
1. Obtain the generator and two data files
The documented nftables workflow uses an nft_geoip.py generator, a location CSV that defines country information, and an address CSV that maps networks to those countries. Obtain the generator and data through the instructions for your distribution and confirm the data’s licensing and update terms. Do not assume that an old CSV remains accurate indefinitely.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsKeep the source CSV files and generated output in a root-owned directory that ordinary users cannot modify. A compromised map can silently turn a country drop into an allow rule, so treat the files as firewall configuration.
2. Generate both address families
Run the generator with the location and address CSV files, following the option names documented by the version you installed. The output should include country definitions plus separate files such as geoip-ipv4.nft and geoip-ipv6.nft. If only one family is produced, stop and resolve that problem before deploying the policy.
Generation is a build step, not a live firewall change. Review the output, record the data date, and retain the previous generated files so you can roll back if a refresh produces an unexpected result.
3. Include the generated files from your ruleset
Your main nftables configuration should include the generated country definitions and both address-map files. The exact include paths vary by distribution and by where you store the generated files. Keep the includes in version-controlled configuration or another change-tracked location so an update is auditable.
4. Mark source addresses in an input chain
The nftables documentation shows the address-family marking pattern:
Rank #2
- 【Professional Firewall & NAS SERVER】OAKNODE 10gbe Firewall Appliance Mini PC-MGNASN, a powerful professional firewall router pc equipped with a 12th Gen Alder Lake N100 4C/4T up to 3.4GHz TDP only 6W with Intel UHD Graphics which maximizes the performance of the 2.5GbE port & SFP+ port, bring you a smooth secured and encrypted network environment.
- 【Rich I/O to meet your needs】Firewall Appliance MGNASN With HDMI 2.0+DP 1.4+TYPE-C(dp 1.2) Support for 3x4K@60Hz together, Dual DDR4 RAM slot support for up to 1x32GB SO-Dimm laptop DDR5 Ram Maximum 5600Mhz and 1xM.2 NVMe/PCIe 3.0x1 2280 SSD slot +1*SATA 3.0 SSD/HDD slots (install externally), also it support boot from TF card slot and it also support PXE/AWOL/Watchdog/GPIO etc. which is perfect for your firewall appliance、VM、Router、home Server needs.
- 【2xSFP+ 10GbE + 4x2.5GbE】This Firewall Router equipped with 2xIntel 82599ES 10gbe network card and 4*Intel i226-V network card speed maximum up to 2.5GbE(need other device like router, cables etc. also support 2.5Gbe/10gbe)which can bring you more faster and professional network usage(some system not release drivers yet) suggest to install version of below systems: pf-sense plus 23.0X or CE 2.7.X, OPNsense 22.1, OpenWrt, ROS7, ESXI 8 , Proxmox, CentOS etc).
- 【4G LTE Function supported】This model also support 4G LTE function(mini PCIE slot for 4G modem) and SIM card slot which you can use it as a IOT devices for your server.
- 【Quality With Warranty】If you have any questions or requirements(like OS installation/ drives/bios updates etc.) on OAKNODE Firewall mini pc MGNASN, PLEASE feel free to contact us. We offered 12 Months warranty for it and WE'LL REPLY YOUR Questions within 12 hours(during Workdays).
meta mark set ip saddr map @geoip4
meta mark set ip6 saddr map @geoip6The generated definitions associate country codes with marks. The first statement classifies IPv4 packets; the second classifies IPv6 packets. In an inet table, place both statements in the input chain before the country decisions. Use the generated map names exactly; do not invent a map for a family your generator did not create.
5. Put the administrator allow-list first
Add explicit accepts for your own administrator addresses or trusted management network before the country drop. Maintain separate IPv4 and IPv6 allow-lists. This ordering protects an approved administrator even if that address belongs to a country you intend to block.
6. Match selected country marks and drop them
After setting the mark, add a decision for each country you want to deny. Use the symbolic mark definitions generated by the workflow, or the numeric values documented in those definitions. The chain should have an explicit policy rather than relying on an implicit default. A conceptual structure is:
Recommended Free Tools
table inet filter {
include '/etc/nftables/geoip-country-definitions.nft'
include '/etc/nftables/geoip-ipv4.nft'
include '/etc/nftables/geoip-ipv6.nft'
chain input {
type filter hook input priority filter; policy accept;
ip saddr @admin_allow4 accept
ip6 saddr @admin_allow6 accept
meta mark set ip saddr map @geoip4
meta mark set ip6 saddr map @geoip6
# Drop rules here use the generated mark for each blocked country.
}
}The example deliberately leaves the country mark names to the generated definitions. A mark is not a country by itself; it has meaning only when it is assigned by the map and interpreted consistently in the same ruleset. If your base firewall already has an input chain, insert the classification and country decisions at a deliberate point rather than creating a second chain whose order you have not checked.
7. Validate, test, and apply
- Check the complete configuration with your distribution’s nftables syntax-check facility before loading it.
- Apply the rules while an existing administrative session remains open.
- From a controlled test source, verify that an allowed address reaches the intended service and that a blocked test network is dropped.
- Inspect the active ruleset and counters to confirm that the expected chain and map are being used.
- Only after the narrow test succeeds should you extend the policy to additional services or make it the default host policy.
Do not infer success from a successful reload alone. A syntactically valid ruleset can still classify the wrong address family, run after an earlier accept, or omit the service you meant to protect.
Implement the same policy with firewalld
Why use firewalld
firewalld provides zones, source matching, IP sets, rich rules, and separate runtime and permanent configuration. It is a practical choice when the VPS already uses firewall-cmd and other administrators expect zone-based changes rather than hand-edited nftables files.
Build an IP set for each address family
Country ranges can be loaded into an IP set and then referenced from a zone or rich rule. A typical workflow is:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
- Create a network-type IP set for the country ranges. Use an IPv4 set for IPv4 networks and an IPv6 set for IPv6 networks; do not place mixed-family data into a set that cannot represent it.
- Load the generated country networks into the appropriate set. Keep the source list and its generation date alongside the firewall change.
- For a reversible test, add the set as a source to the target zone at runtime. firewalld’s manual defines a source as an IP address, network address, MAC address, or an IP set referenced with the
ipset:prefix. - Test the affected service while the runtime rule is active.
- When the result is correct, repeat the change in permanent configuration and reload firewalld. Verify that the set entries and zone source still exist after the reload.
For example, the command sequence below illustrates the objects and order; option details can differ slightly between firewalld releases, so check the local firewall-cmd manual before running it:
firewall-cmd --permanent --new-ipset=country_block4 --type=hash:net --family=inet
firewall-cmd --permanent --ipset=country_block4 --add-entries-from-file=/root/geo/country-ipv4.txt
firewall-cmd --permanent --zone=public --add-source=ipset:country_block4
firewall-cmd --reloadRepeat the design for IPv6 with an IPv6-capable set and the IPv6 country list. If you need different treatment for SSH, HTTP, and another service, use a zone or rich rule structure that expresses that scope instead of attaching a broad source to every service unintentionally.
Runtime versus permanent state
A runtime change is valuable for a safe trial because it disappears on a restart or when replaced by a reload. Permanent configuration is what firewalld restores. A common operational error is to test a runtime IP set, make a permanent zone change without adding the set entries permanently, and then discover after reboot that the country list is empty. Check both the set definition and its entries in the permanent view before declaring the deployment complete.
Do not mix firewalld direct rules casually
Rich rules should be preferred when they can express the requirement. firewalld’s direct-rule documentation warns that, with FirewallBackend=nftables, a direct-rule ACCEPT action does not necessarily accept a packet immediately; the packet can still be evaluated by firewalld’s nftables ruleset. The same documentation says direct-rule DROP actions are immediately dropped regardless of backend.
This asymmetry can produce an especially confusing result: a direct ACCEPT appears in the rules, yet a later firewalld rule still blocks the packet, while a direct DROP takes effect sooner than expected. Before adding direct rules, map the complete evaluation path, backend, table, chain, priority, and existing zone policy. If a rich rule or IP-set source can express the policy, keep it inside firewalld’s normal model.
Safe rollout checklist for a remote VPS
- Confirm recovery access. Verify that your VPS provider’s out-of-band console works and that you know how to use it before changing the firewall.
- Protect management addresses. Add explicit IPv4 and IPv6 accepts for your own administrator IPs or trusted management network before country drops.
- Cover both families. Generate, include, and test separate IPv4 and IPv6 maps or IP sets.
- Start narrow. Apply the policy to a test port or one service before expanding it to the whole input path.
- Keep a rollback ready. Preserve the previous ruleset and prepare the command or console procedure that restores it.
- Keep a session open. Do not close the verified management connection until a second connection succeeds under the new rules.
- Observe matches. Add counters and temporary logging to the country decisions, then remove or reduce noisy logging after validation.
- Schedule data refreshes. Country allocations change. The source documentation describes retrieving the address CSV and regenerating maps but does not prescribe a universal update interval; choose one appropriate to your risk and change-control process.
Logging and counters that prove the rule is being used
nftables supports rule-level logging and counters. Add a counter to each country decision and, during testing, a log prefix that identifies the country and service. The nftables documentation notes that full logging support begins with Linux kernel 3.17. Confirm that your VPS kernel and log collection path can handle the volume before enabling broad packet logging.
After generating test traffic, list the active chain and verify that the relevant counter increases. A zero counter can mean the country has no traffic, but it can also indicate an incorrect map include, an IPv6 path you forgot to classify, an earlier accept, or a chain that is not hooked where you expect. Use logs for short diagnostic windows rather than leaving high-volume country drops permanently verbose.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
Updating GeoIP data without creating a gap
Regenerate outside the live ruleset
Download or retrieve fresh location and address CSV files into a staging directory, run the generator, and inspect the resulting definitions and IPv4/IPv6 maps. Keep the previous generated set until the new one has passed syntax and sanity checks.
Validate the new files
- Confirm that both address-family files exist and are non-empty.
- Check that the country definitions referenced by your drop rules are still present.
- Check for accidental path or ownership changes.
- Load the candidate configuration in the same validation mode used for ordinary firewall changes.
Switch atomically where possible
Prepare the complete new ruleset or firewalld IP-set contents first, then reload once. Avoid editing a live map line by line while the policy is serving traffic. Record the data version and timestamp so an incident can be correlated with a specific country allocation snapshot.
Retain a rollback
If legitimate clients are suddenly denied or a generator update fails, restore the prior generated files and ruleset, reload, and investigate the data change separately. Do not disable your entire firewall merely because the country data needs correction.
Troubleshooting by symptom
You lost SSH immediately after applying the policy
Use the provider console, restore the previous ruleset, and add your administrator IPv4 and IPv6 addresses to the allow-list before trying again. If your address is dynamic, allow a trusted management network or use a controlled bastion rather than repeatedly adding temporary addresses.
IPv4 is blocked but IPv6 still works
Check that the IPv6 CSV was generated, its map is included, and the ip6 saddr marking statement runs before the country decision. Verify that the service is listening on IPv6 and that the drop rule is in the same effective input path.
The country drop counter never increases
Confirm that the source map contains the test network, that the generated mark definition matches the mark tested by the drop rule, and that an earlier accept is not terminating evaluation. In firewalld, verify that the IP set contains entries in the active configuration and that the zone source uses the exact ipset: prefix.
The rule works until reboot
With raw nftables, check that the generated includes are part of the boot-time configuration. With firewalld, distinguish runtime from permanent state, add both the IP-set definition and entries permanently, then reload and test again.
Best Value
- 【CPU Optimized for Firewall Mini PCs】This firewall appliance is powered by Intel Quad-Core Celeron J1900, 64-bit, up to 2.0 GHz, supporting software-based encryption. Energy-efficient and reliable, it runs 24/7 for home or small office networks, handling VPNs, multi-WAN routing, and basic firewall tasks efficiently.
- 【4×Intel i210 Ports】Equipped with four Intel i210 network controllers, each delivering up to 1 GbE for reliable multi-WAN routing, VPN connections, VLAN management, and stable performance in small office or home firewall deployments
- 【Memory & Storage】This Firewall Mini PC comes with 4 GB DDR3L RAM and a 64 GB mSATA SSD, providing reliable performance for basic networking tasks. AMI BIOS with ACPI support ensures stable system operation and energy-efficient 24/7 use
- 【Flexible System Compatibility】Compatible with Windows 10, Linux, and professional firewall systems such as pfSense, OPNsense, and VyOS, ensuring stable network management for home or small office use
- 【After-Sales Support:】This compact, fanless, and silent firewall keeps your network secure. Includes lifetime technical support and a 30-day money-back guarantee!
An ACCEPT direct rule does not override a block
On an nftables-backed firewalld host, this is the precedence behavior documented for direct rules. Replace the direct rule with an appropriate rich rule or zone/IP-set design, or deliberately redesign the chain priorities after reviewing the full firewalld ruleset.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Logging overwhelms the VPS
Limit logging to a short test window, add rate controls where supported by your ruleset, and rely on counters for ongoing observation. A country-wide block can match large volumes of scans, making packet-by-packet logs expensive.
Operational decisions that prevent common mistakes
Block at the host or at the service?
A host-wide input drop is simple and reduces work for every daemon, but it also affects monitoring, backup, administration, and future services. A service-specific rule is safer when only a web application or an administrative port needs geographic restriction. Start with the smallest scope that answers your threat or compliance requirement.
What should happen to unmatched addresses?
A generated map may not classify every source. Decide separately whether unmatched traffic follows your normal firewall policy or an explicit default. Country blocking should not silently become an allow-list for the entire Internet unless that is your deliberate design.
How often should the data be refreshed?
There is no universal interval in the cited nftables workflow. Choose a cadence based on how quickly your exposure changes, automate retrieval and validation, and require a rollback artifact for every refresh. A frequent update that is not tested can be less safe than a slower, controlled update.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Bottom line
For a new Linux VPS, build country maps for both IPv4 and IPv6, classify source addresses with nftables maps, and drop only the generated marks that represent the countries you intend to deny. If firewalld already manages the host, load the same ranges into IP sets and reference them through zones or rich rules, keeping runtime and permanent state distinct. Protect management access, test narrowly, observe counters and logs, and maintain a reversible map-refresh process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
