Our datacenter has recommended we block all RIPE IP Addresses on one of our machines. It is constantly being DDoS Attacked everytime the null routes are lifted, so I am not sure how this would help, but am more than willing to try anything now.
I couldn't find much information on it from a Google search, but how can we block all RIPE IP Ranges? Preferably I wouldn't even mind blocking all Ranges that were not US Based since that is the only target we traffic, but this is probably too difficult.
You have two choices. You can block the incoming packets or you can block the replies. Generally, it's more efficient to block the replies because you can just do that with a route. But you can filter the inbound packets in your firewall.
Here are the networks you need to block, arranged as CIDR blocks:
Triple check everything!
RIPE NCC addresses list, and formatting for IPSET and Wireshark / tcpdump
RIPE NCC covers Europe, the Middle East, and Central Asia
This list will change with passage of time. So verify with the authoritative sources.
https://www.iana.org/numbers
https://www.arin.net/
Server is much "happier" with RIPE blocked.
Other regions can be blocked in the same manner.
Those wishing to access from a blocked region can do so by using a VPN service hosted in an unblocked region.
Wireshark / tcpdump capture filter:
iptables:
ipset: