Why Governments Block IP Ranges Instead of Individual Websites

When an internet service provider blocks a website, the restriction may target a domain name such as example.com, or it may affect the numerical IP address where that site is hosted. Blocking an entire IP range is a broader measure: it can make hundreds or thousands of websites unreachable through the same network route.

This distinction matters because modern websites rarely operate from one permanent server. They use cloud platforms, content delivery networks, shared hosting, reverse proxies and security providers. A single address can therefore support unrelated news outlets, online shops, community forums and public services in several countries.

For people in Australia, the practical effects can appear during ordinary browsing on an NBN connection in Sydney, Melbourne or Brisbane. A site may load on a mobile network but fail through a home ISP, or work in one suburb while timing out elsewhere. These inconsistencies can be signs of filtering, routing trouble or a faulty DNS response rather than a problem with the website itself.

Net Neutrality Monitor tracks these differences through country-specific checks, DNS data, blacklist records and network probes. Its results are intended for indicative research, so a blocked result should be treated as evidence to investigate rather than a final legal or technical verdict.

Why Range Blocking Is Attractive to Authorities

An IP address is a direct routing destination, which makes it convenient for network operators to restrict. A firewall or filtering appliance can reject traffic to a block of addresses with one rule. By contrast, domain-level censorship may require constant updates as websites change domains, subdomains, hosting providers or encryption settings.

Ranges are also useful when a government wants to suppress a service that distributes content across many domains. If an organisation uses several addresses on one provider, blocking the provider’s allocated range can appear simpler than identifying every domain connected to it. The same method may be used against file-sharing platforms, circumvention services, gambling sites or political publishing networks.

The policy can be especially tempting where regulators expect ISPs to act quickly. A broad address block can be deployed during an election, protest or security incident without waiting for a detailed classification of each site. Speed, however, often comes at the cost of accuracy.

Shared Hosting Turns One Block Into Many

The central technical problem is collateral damage. Hosting companies commonly place unrelated customers on the same IPv4 address, while cloud services assign addresses dynamically. Blocking one address can therefore affect a local business, an international retailer and a personal blog at the same time.

Content delivery networks make the picture more complicated. A website may resolve to different addresses depending on the visitor’s country, ISP, time of day or network conditions. A block aimed at one service can accidentally disrupt other services that happen to share an edge server or address pool.

This is familiar to Australian users who access overseas services from a regional town, where traffic may take a different path from traffic generated in central Melbourne. A small business relying on an international booking platform could experience an outage even though the platform itself has never been specifically named by a regulator.

DNS Filtering Does a Different Job

DNS filtering interferes with the lookup that converts a domain name into an IP address. A resolver might return an incorrect address, refuse the request or redirect the user to a warning page. IP filtering operates later, after the destination address is known, and can block the connection even when the user enters an address directly.

The two methods can overlap. A blocked domain may fail because the DNS answer has been altered, because the resulting IP address is filtered, or because both controls are active. Comparing results from an ISP resolver, a public resolver and an encrypted DNS service can help separate these causes. This DNS censorship comparison explains why visible DNS manipulation and encrypted lookups can produce different observations.

Encrypted DNS can hide the contents of a lookup from some intermediaries, but it does not guarantee access. If the final address is blocked, changing the resolver may make no difference. Conversely, if only the DNS answer is being tampered with, a different resolver may restore access without changing the route.

Why Governments Choose Broad Controls

Range blocking can be connected to national security rules, copyright enforcement, sanctions, emergency powers or efforts to limit access to prohibited material. The legal justification differs between countries, and the published reason may be less specific than the technical implementation.

Operational pressure also plays a role. Regulators may send a list of domains to ISPs, while the ISP’s filtering equipment groups those domains by address or hosting provider. An automated system may then block an address range because it cannot distinguish one virtual host from another. The final restriction can be wider than the original order.

Similar questions arise when authorities monitor digital services connected to physical-world enforcement. For example, debates about drone privacy rules show how a narrowly defined objective can raise wider questions about proportionality, oversight and unintended impact. Internet blocking has the same pattern: the stated target may be specific, while the technical measure reaches much further.

What Measurement Can Reveal

A useful censorship measurement compares the same domain or address from multiple networks and locations. If a website fails only on one ISP, the cause may be local filtering, DNS interference or a routing fault. If it fails across several networks in the same country but works elsewhere, a national restriction becomes more plausible.

Probe-based testing provides stronger evidence than a single user report. Net Neutrality Monitor’s network probes help compare responses from different vantage points, while blacklist and statistical records can show whether a result is isolated or part of a larger pattern. Repeated measurements are valuable because outages, DNS changes and cloud reassignments can create temporary false positives.

Researchers should record the time, resolver, network type, destination address and response behaviour. A timeout, connection reset, HTTP block page and DNS error each suggest different mechanisms. A result from a home NBN service should not automatically be treated as representative of every Australian network.

Practical Checks for Australian Users

Australia has a relatively diverse access market, including Telstra, Optus, TPG, Vodafone and numerous smaller providers. Mobile and fixed-line traffic may use different DNS resolvers, upstream carriers and filtering policies. Testing across a home connection and a mobile hotspot can therefore provide a useful first comparison.

Local conditions matter as well. A user in Perth may reach an overseas cloud region through a different transit path from someone in Sydney, while regional customers may depend on fewer upstream routes. During major events, infrastructure maintenance or submarine cable disruptions, a routing problem can resemble censorship.

Useful Signals to Record

• The domain, IP address and exact time of each test
• Whether the failure is a timeout, reset, redirect or DNS error
• The ISP, connection type and country-level location
• Whether the same resource works through mobile data or another resolver

Checks That Reduce Misinterpretation

• Compare at least two networks before reporting a national block
• Check whether several unrelated domains share the affected address
• Repeat the test after DNS records or cloud hosting may have changed
• Separate a policy block from an ordinary outage or routing failure

Comparing Blocking Methods and Evidence

The difference between a domain block and an IP-range block is important for businesses that depend on online services. A small Australian retailer using a shared e-commerce platform may be caught by an address restriction even though its own domain is lawful and never appeared on a blacklist. Organisations evaluating private connectivity services should also understand that a different access path can change the observed result without proving that the destination is universally available.

Method	What is filtered	Typical reach	Common weakness
Domain blocking	A domain or hostname	Usually narrow	Easy to evade through domain changes or alternate names
DNS tampering	The lookup response	Affects users of the targeted resolver	Encrypted or alternate DNS may bypass it
Single IP blocking	One server address	Can affect multiple hosted services	Shared infrastructure creates collateral damage
IP-range blocking	A group of addresses or provider allocation	Potentially very broad	Unrelated websites and services may be disrupted
Route filtering	Traffic path or destination prefix	Can affect entire networks or regions	May be difficult to distinguish from an outage

A report should therefore describe the observed mechanism instead of simply labelling a site “blocked”. The strongest account combines DNS responses, connection tests, address ownership, repeated measurements and comparisons across ISPs. Public information about digital public services can also show how network availability affects real administration; an example of rural e-government illustrates why access failures can have consequences beyond entertainment or social media.

A blocked IP range is a blunt instrument because the internet’s hosting structure is shared, dynamic and geographically distributed. For Australian users and researchers, the practical takeaway is to compare networks, record technical symptoms and treat a broad block as a signal to investigate the whole path—not just the website that first appeared unreachable.