On Wed, 6 Dec 2017 16:41:08 +0200, "Joaquim Homrighausen"
 wrote:

>Does anyone know of an alternative to ipset for blocking IP ranges of entire 
>countries, that works with OpenVZ containers?

I wish...

I use fail2ban. OpenVZ containers have limited memory and you can soon
fill it up with an all the subnets. With fail2ban you can block the
offenders easily. I have a "permaban" chain for those repeat
offenders.
--- SBBSecho 3.03-Linux