Geo Blocking: Block or Allow Countries on Your Server

Block countries, or allow only some

Geo Blocking

Geo Blocking drops every packet that reaches your server's public interface from the countries you choose, or from every country except the ones you choose. The address lists come from the RIPE registry, are loaded into the server once, and are matched by a single firewall rule, so the cost per packet does not grow with the number of countries.

Where: Servers › My Servers › your server › System › Security › Geo Blocking

01 · Choose a mode

Block the listed countries

Traffic from the countries you pick is dropped. Everything else passes to your firewall rules as before.

Allow only the listed countries

Traffic from every country you did not pick is dropped. Use it for a server that only ever serves one region.

02 · Pick the countries

Type in the search box and tick the countries. Each one appears as a chip above the list; the × on a chip removes it.
Under Always allow, add any address or network that must always get through, one per line or comma separated, for example your office or a partner's server.
Click Apply. The first time a country is used its address list is fetched, which can take a few seconds for a large country.

You stay in control. A configuration that would block the address you are connected from is refused, unless that address is in Always allow.

03 · What is never affected

Traffic inside your WireGuard network, and the WireGuard port itself.
Every Opensolr server: the Solr fleet, the managed servers, the load balancers and the management addresses. Your indexes, crawlers and replication keep working, and the server can always be managed from here.
The networks your WireGuard devices connect from. They are added automatically and updated when you change the links.
Everything under Always allow.

04 · The status line

The card shows what the server reports: the active mode and countries, how many networks are loaded (IPv4 and IPv6), how many addresses are always allowed, the public interface the rule is bound to and the WireGuard port kept open.

05 · Keep it current, or remove it

The country lists are refreshed from RIPE every week and re-applied on your server when they change. Nothing to do on your side.
Enabling or disabling the firewall, or a reboot, keeps geo blocking in place.
Remove geo blocking takes it off completely. Your firewall rules are untouched either way.