What is geolocation data; where does TR7 perform country-based control?

Short answer

Geolocation data is the mapping of an IP address to continent, country and city information; it is an approximate mapping based on address records. TR7 performs this mapping from the IP database on the device; IP Lookup on the IP Intelligence & Reputation screen shows the continent, country and city information of an address. Country-based control is performed in several places: in Load Balancer, with the Country type of the Source IP condition; in Bot/DDoS, in the Country Control block of L7 DDoS Protection, with a per-country request or connection limit if a limit is written in the rule row, and with a direct action as soon as the country matches if the limit is left empty; at the network layer, with the Country source of the Firewall rule; in GTM, with Balance Algorithm = Geographic Proximity and Topological Selection. Private network addresses are treated as Local Networks instead of as a country.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → Settings → General Settings → IP Intelligence & Reputation	IP Lookup → Location	Seeing the continent, country and city information of an address
IP Intelligence & Reputation → Distribution	Blacklist by Country, Local Networks, Country Unknown cards	The distribution of the addresses in the list across countries; addresses whose country cannot be resolved are counted as Country unknown
Configuration Menu → Load Balancer → Conditions (Policy Match)	Source IP → Country, City	Routing or blocking based on the country or on the province in Turkey
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → L7 DDoS Protection	Country Control	A per-country limit or a direct action; exemption with Exempt Countries
Configuration Menu → Network → Firewall	Source = Country	Allowing or blocking by country at the network layer
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management	Whitelist & Known Peers → country entry	Exempting the traffic of a country from the L4 DDoS rules
Configuration Menu → GTM → GTM Services → service → Records	Balance Algorithm = Geographic Proximity, Topological Selection	Selecting the DNS response according to the location of the client
Left Monitor Panel → WAF-Protected vServices → vService → Dashboard	Detected Attacks by Country	The distribution of attacks across source countries

• Country blocking methods: Can I block traffic from specific countries?
• Routing by country: Can I route clients to a different backend based on their country / city?
• Updating of the data: Where do geolocation and IP reputation data come from and how often are they updated?

Common Misconceptions

• "A country block stops the attacker." An attacker who uses a VPN or a server in another country can bypass the country control; country control is an additional layer used together with protections such as IP Reputation Protection and Bot Protection.
• "Location data is exact for every address." Geolocation is an approximate mapping; addresses that have no entry in the database cannot be placed in a country. For mobile and VPN users, the country information may differ from the real location of the user.
• "TR7 sees the country of the client even while sitting behind a CDN." On an HTTP vService, if the real IP of the client is not resolved with Trusted Proxy, the country is determined by the address of the CDN; the Firewall rule, on the other hand, always looks at the source address of the connection.

How it is done in the documentation

• IP Intelligence & Reputation · IP Lookup
• Source IP · Country
• Country Control · What Is Country Control?
• Firewall · Country
• Records · Balance Algorithm

Related questions

• Can I block traffic from specific countries?
• Can I route clients to a different backend based on their country / city?
• Where do geolocation and IP reputation data come from and how often are they updated?
• What is an ASN; where do I see and use ASN information in TR7?