Skip to content

GEO Rules

GEO rules allow, block, or monitor requests based on the resolved country code for the client IP address.

GEO database dependency

GEO enforcement requires a country lookup source such as a compatible local GEO database, trusted upstream GEO metadata, or a manual CIDR map. Commercial GEO databases are not bundled with VNetArmor. Customers are responsible for obtaining and maintaining any third-party GEO database license required by their chosen provider. See GEO Location Filtering and Database Licensing.

Evaluation Inputs

VNetArmor can resolve country information from:

  • A configured GEO database file.
  • Trusted proxy or CDN country headers.
  • A manual CIDR-to-country map.
  • UNKNOWN fallback when no country can be resolved.

Only accept country headers from trusted proxy CIDRs. Do not trust country headers sent directly by internet clients.

Syntax

RULE=<rule_name>
ACTION=<ALLOW|BLOCK|MONITOR>
IF COUNTRY=<ISO_CODE|ISO_CODE_LIST|*|UNKNOWN>

Route-specific policy pattern:

ROUTE=<host>:<path_prefix>
RULE=<rule_name>
ACTION=<ALLOW|BLOCK|MONITOR>
IF COUNTRY=<ISO_CODE|ISO_CODE_LIST|*|UNKNOWN>

Examples

Default allow:

RULE=geo_default_allow
ACTION=ALLOW
IF COUNTRY=*

Monitor unknown countries:

RULE=geo_monitor_unknown
ACTION=MONITOR
IF COUNTRY=UNKNOWN

Block selected countries:

RULE=geo_block_selected
ACTION=BLOCK
IF COUNTRY=KP,RU

Allow selected countries for an administrative route:

ROUTE=admin.example.com:/admin
RULE=admin_allow_gb_us
ACTION=ALLOW
IF COUNTRY=GB,US

Block all other countries for the same route:

``text ROUTE=admin.example.com:/admin RULE=admin_block_other_countries ACTION=BLOCK IF COUNTRY=* 

## Manual GEO Map

Manual CIDR maps are useful for labs, private ranges, and controlled exceptions.

```text
203.0.113.0/24=GB
198.51.100.0/24=US
192.0.2.0/24=CA

Manual mapping is not a replacement for a regularly updated production GEO database.

Example server.conf Keys

geo_enabled=true
geo_rules_file=/etc/vnetarmor/geo/geo_rules.conf
geo_db_path=/etc/vnetarmor/geo/GeoIP-country.mmdb
geo_ip_map_file=/etc/vnetarmor/geo/geo_ip_map.conf
geo_trusted_proxy_cidrs=10.0.0.0/8,192.0.2.0/24
geo_unknown_action=MONITOR
 ```


For containers, use mounted paths such as:

```ini
geo_rules_file=/config/geo/geo_rules.conf
geo_db_path=/config/geo/GeoIP-country.mmdb
geo_ip_map_file=/config/geo/geo_ip_map.conf

Best Practices

  • Use monitor mode before enforcing a new country block.
  • Use a paid or organization-approved GEO database for production.
  • Update the GEO database regularly.
  • Document the business reason for country blocks.
  • Use trusted proxy CIDRs when accepting country headers from load balancers, CDNs, or reverse proxies.
  • Keep a break-glass administrative access path that is not accidentally blocked.
  • Treat UNKNOWN as a separate policy decision.

Common Problems

Problem Cause Fix
Country is always UNKNOWN Database missing, wrong path, permissions, or unsupported file. Verify file path, owner, permissions, and Core logs.
Country is based on proxy IP Trusted proxy/client IP extraction not configured. Configure trusted proxy CIDRs and approved forwarding headers.
Unexpected block Rule order, broad wildcard, outdated GEO database, or route-specific match. Switch to monitor mode and review logged rule_id.
GEO headers ignored Source IP is not trusted. Add only approved proxy CIDRs.

See GEO Location Filtering and Database Licensing for database licensing, update procedures, logging examples, and troubleshooting.