Implementing Geo-Fencing IP Blocking to Prevent Foreign Access to Home Assistant

Let's be honest. You spend hours configuring your Home Assistant. You get your automations just right. The last thing you want is some random IP from a country you've never visited poking at your login page. It's not just paranoia. That's the first step in a brute-force attack. Geo-fencing, or GeoIP blocking, is like putting up a "No Entry" sign for entire continents. It's a brutal, simple first line of defense. Your smart home shouldn't be a global bus terminal.

The Great GeoIP Debate: Router vs. Server

Here's the thing. You can block countries at two main points: your router or the server running Home Assistant (like a NAS or Raspberry Pi). The router is the king. Block it there, and the traffic never even enters your network. It's clean. Efficient. But it depends on your router having a decent firewall. If you're using some ISP-provided plastic box, you might be out of luck. The server-level block is a good backup. But it's like locking your bedroom door after leaving the front door wide open. Do both if you can. Start with the router.

Hands-On: Blocking Nations with pfSense/OPNsense

This is where the magic happens. I'm a fan of pfSense/OPNsense. It makes this stupidly easy. You create an "Alias" – basically a list. You call it "BLOCK_COUNTRIES". Then you add geo-location codes. CN, RU, BR, IN... you get the idea. Any IP geolocated to those countries gets added to the list automatically. Then you make a firewall rule: "Block any traffic from the BLOCK_COUNTRIES alias." Apply it to your WAN interface. Boom. Done. It feels powerful. And it is.

But Wait, How Do You Know It's Working?

You can't just set it and forget it. Well, you can, but you shouldn't. Check your firewall logs. Seriously, go look. You'll see lines of "block" or "drop" actions with source IPs. Do a quick "what is my IP" search from a VPN set to a blocked country. Try to hit your Home Assistant URL. Nothing. Silence. That's the sound of security. It's also a good reminder that you need a safe way back in for yourself...

The Critical Flipside: Your Secure Backdoor (VPN)

And this is the most important part. If you're blocking the whole world, you need a guaranteed way in. A VPN. WireGuard running on your firewall is perfect for this. It's fast, modern, and simple. Your phone connects to the VPN, and *poof*, you're back on your home network as if you're sitting on the couch. No open ports for Home Assistant. No exposure. The geo-block doesn't apply to you. This isn't an optional step. It's mandatory.

Monitoring, Tweaking, and Staying Sane

Security isn't a one-time chore. It's a habit. Glance at those firewall logs once a week. See a new country popping up in the block list? Maybe add it. Notice you blocked a country you're planning to visit? Temporarily adjust the rule or just use your VPN. The goal isn't to build an impenetrable fortress that you can't manage. The goal is control. You decide who knocks on your digital door. Everyone else gets a silent, firm "not welcome".