Firewall — Blocking by ASN, GEO, UA

What this solution does

The firewall module for 1C-Bitrix provides flexible protection against unwanted traffic. Blocking is applied based on ASN number, country GEO code (e.g., NL, RU, US), or a specific string in the UserAgent. Access can be restricted for all visitors except those from Russia. Filtering modes can be combined arbitrarily, including the use of blacklists and whitelists based on geolocation.

The solution allows blocking entire networks of specific providers or hosting services with a single setting, eliminating the need to manually add each IP address or subnet. This ensures reliable protection against traffic from specific countries or networks.

Key capabilities:

— Rapid blocking of specific provider networks.

— Visitor filtering by geolocation in blacklist or whitelist modes.

— Instant geolocation determination using the local GeoLite2-Country.mmdb database.

— Bot blocking based on a matching string in the UserAgent.

— Restricting access to a specific URL on the site.

— Ensuring IP addresses on the whitelist are never blocked.

— Ensuring ASN networks on the whitelist are never blocked.

The Firewall module (blocking by ASN, GEO, UA) protects all server domains and IP addresses. Unwanted traffic is blocked based on Autonomous System Numbers (ASN), geolocation, and UserAgent parameters. Optimization and caching ensure the module does not affect site speed. When blocked, visitors see a clear notification and can unblock themselves. Selected UserAgents are never blocked, and all blocking events are logged.

The module supports strict visitor filtering by geolocation in both black and white list modes. A local GeoLite2 database is used to instantly determine the visitor's location. Simply provide a link to the file, and the module will update it daily.

To prevent blocking real visitors, a JS challenge is available on the 403 error page for self-unblocking. When accessing the site, the user's browser solves a cryptographic task transparently. Most bots cannot pass this challenge, although some may succeed. This mechanism reduces the overall protection level but minimizes the risk of blocking legitimate users.

The firewall for 1C-Bitrix operates based on IP address verification. The system checks if a visitor's IP falls within blocked ranges and denies access if a match is found. The filtering logic relies on the practice of traffic segmentation: traffic from hosting provider networks is often considered malicious, while traffic from internet service provider networks is considered useful.

The Firewall module (blocking by ASN, GEO, UA) is designed to completely block traffic from bot, scraper, and checker networks that are difficult to stop with standard IP-based methods due to their use of vast numbers of subnets from providers like DigitalOcean, OVH, and AWS. Since legitimate users rarely access the internet through such networks (though exceptions exist), it is possible to completely block traffic from these hosting providers.

This is a powerful tool for 1C-Bitrix requiring careful use. Treat it with zero trust: all traffic from the selected provider will be blocked except for explicitly specified IP addresses and URLs. Regularly monitor the block log to avoid inadvertently blocking access for clients, search engine bots, or services on other platforms.

General iT can install and configure this module and check how it works on your website.