GeoBlocking
Navigate to the sidebar menu: Protection > Policies, open a Standard Policy, and select the GeoBlocking tab in the top navigation bar.
Overview
The GeoBlocking module allows you to block access to websites and services based on the geographic location of the server hosting them. By analyzing the IP address of the destination server, the system determines its physical country. If that country is on your block list, the connection is instantly stopped at the DNS level.
Why use GeoBlocking?
- Security: Reduce your "attack surface" by blocking connections to countries known for high rates of cybercrime or where you have no business interests.
- Compliance: Enforce embargoes or corporate policies regarding data traffic to specific regions.
Interface Overview
The dashboard is organized to let you drill down from broad continents to specific countries:
- Left Sidebar: Lists the geographic regions (e.g., Africa, Europe, Satellite Provider).
- Main Panel: Displays the individual nations within the selected region, each accompanied by its national flag for quick recognition.
Understanding the Modules
Countries are grouped by continent or macro-region to simplify management. Use this table to understand the available grouping logic.
Category / Region | Focus & Description |
|---|---|
Major Continents | Includes the primary global landmasses: Africa, South America, North America, Antarctica, Asia, Europe, and Oceania. |
Strategic Sub-Regions | Allows for targeting specific geopolitical areas without blocking an entire continent. Includes the Baltic States, Middle East, North Africa, and Caucasus. |
Satellite Provider | Blocks traffic routed through satellite internet providers (e.g., Starlink, Inmarsat), which often bypass traditional geolocation checks and mask the true origin of the user. |
IP Unspecified | Catches traffic where the destination IP address does not have a clear geographic assignment in the global registry, often a sign of anonymized or suspicious infrastructure. |
Configuration & Logic
- Toggle ON (Blue): Traffic to this country is BLOCKED.
- Toggle OFF (Grey): Traffic to this country is ALLOWED.
- Enable All / Disable All: Located at the bottom-right of the panel. Checking this box instantly blocks all countries in the currently selected region. Unchecking it disables the global block, allowing you to select individual nations.
Be very careful when blocking major regions like North America or Europe. Modern websites use CDNs (Content Delivery Networks) like AWS, Cloudflare, or Google Cloud. A website for a local Italian business might actually be hosted on a server in the United States or Ireland. Risk: If you block the US, you might accidentally block legitimate services (like Gmail, Microsoft 365, or parts of legitimate websites) that rely on US-based servers. Recommendation: Only block countries where you are certain you will never need to connect (e.g., high-risk nations) and monitor your Exceptions list if legitimate sites get blocked.
How to Unblock a Legitimate Website
Option 1: Add the Domain to Your Custom Whitelist
- Navigate to the Custom Lists section.
- Open Personal Whitelists (or Allowed Lists).
- Enter the domain you want to unblock.
- Apply the exception to the current filtering policy
- Save your changes and verify that the website is accessible.
Option 2: Check Geoblocking Settings
- Open the relevant DNS filtering policy.
- Navigate to the Geoblocking settings.
- Check whether the country associated with the website is blocked.
- If necessary, add the domain to the appropriate geographic exceptions or temporarily adjust the Geoblocking restriction.
- Save your changes and test access to the website.