Home / server / Questions / 1028753
In Process
cvlo
Asked: 2020-08-04 15:38:53 +0800 CST

Does CDN defeat the purpose of server-level GeoIP blocking?

  • 772

Looking for second opinions.

Suppose a website is set up so that only IPs from country X are allowed read/write access. This server goes through a CDN such as Cloudflare. Because the GeoIP block is at server level, it never gets enabled because Cloudflare will always cache from an IP in country X and broadcast worldwide so anyone outside of country X will still be able to read the version that was cached by Cloudflare locally.

Does this mean IPs from GeoIP blocked countries (outside of country X) will also have write access?

cloudflare cdn geoip

1 Answers

  1. Yes.

    You need to implement your geo blocking at the CDN level. This usually means paying for the CDN as this is typically not included in free tiers (they'll give you space for a few rules, but the kinds of rules you need for geo blocking will normally exceed the free allocation).

    You can geo-block based on the X-Forwarded-For header but as you've correctly summised the CDN will just serve a request out of its cache. Which is the the point of a CDN.

    • 4