Can I block traffic from specific countries?

Short answer

Yes. The most common way is to select, in the Source IP condition, Source IP Type = Country and bind the condition to the Block action on an HTTP vService, or to the TCP Connection Management action on an L7 TCP vService; for an allow rule such as "only Turkey", the negative (NOT) form of the condition is used. A condition selects a single country; for more than one country, conditions are combined with or, or a single Dynamic List condition is used. On vServices with Bot/DDoS protection on, L7 DDoS Protection → Country Control does the same job, and independently of the vService, at the network layer, the Firewall rule's Country source does the same job.

Problem: Traffic from Specific Countries Is Not Wanted

Because of license or regulatory restrictions, the concentration of attacks from specific countries or the service being offered only to a specific country, traffic from some countries needs to be blocked, or only specific countries need to be allowed. TR7 determines the client's country from the source IP address, with the geographic IP database on the device (IP Intelligence & Reputation). To send the user to other servers instead of blocking them, routing is used: Can I route clients to a different backend based on their country / city?

Solution: Four Methods

The methods are alternatives to each other; more than one of them does not need to be applied to the same traffic at once.

Your situation	Suitable method
Blocking, or allowing only one country, on an HTTP or L7 TCP vService	Method 1: Source IP (Country) condition + action
Bot/DDoS protection is on in the vService; I want to keep the country rule in the same place as the limits	Method 2: L7 DDoS Protection → Country Control
Blocking at the network layer, independent of the vService rules	Method 3: Firewall (Country)
From the command line	Method 4: WEB-CLI

Method 1: Source IP (Country) Condition + Action Recommended

• How it works Requests that match the condition are met with the action before they reach the Backend Service: on HTTP, Block (default 403) or, for an information page, Show Content; on L7 TCP, TCP Connection Management. If the negated form of the condition is selected, everyone outside the country in the list is blocked.
• Where it is openedLoad Balancer → Conditions · Load Balancer → Actions · vService → Details → Actions
• Requirement There is no change on the Backend Service side
• vService type HTTP · L7 TCP (there is no Actions field on a Network vService)

Step-by-Step Configuration

1

Adım 1 Open the condition form

On the Load Balancer → Conditions screen, Add is clicked (how to add).

2

Adım 2 Select the country

Condition Name is entered; Criteria = Source IP and Source IP Type = Country are selected, and the country is selected from the Country list. The form opens with Turkey selected; at the top of the list, there is a Local Networks entry for local networks. The field takes a single country; a separate condition is created for each country to be blocked.

Many countries

For many countries in a single condition, Criteria = Dynamic List is selected: in the Key to search field, the Client country variable is selected with fx, Search Method is set to Exact match, and a two-letter country code (e.g. RU) is written on each line of the List field. Condition protocol is selected according to the vService type (HTTP or TCP). The remaining steps are the same.

3

Adım 3 Save the condition

Add is clicked; the condition is added to the list. For more than one country, steps 1–3 are repeated for each country (Add & Repeat keeps the form open).

4

Adım 4 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

5

Adım 5 Select the action and the condition

Action Name is entered and the Action Type is selected according to the vService type:

vService	Action type	Setting
HTTP	Block	Execution Level = On Request, Deny Type = Standard, Status Code default 403
HTTP, if a page is to be shown to the blocked clients	Show Content	Content Page (default Access Denied Page) and Status Code; since the Status code default is 200, 403 or 451 is selected. For a custom page: What is the Content Pages profile; how do I prepare my own HTML page?
L7 TCP	TCP Connection Management	Action = Reject or Silent Drop (Is it possible to reject or silently drop a connection at the TCP level (TCP Connection Management)?)

In the Conditions field, the conditions from step 3 are selected and combined with or in the same group. For "only this country", the negated form of the condition (shown as !ConditionName in the list) is selected (Can I use a condition in negated form ("if not")?). Optionally, Hit Counter is turned on.

6

Adım 6 Save the action

Add is clicked; the action is added to the list.

7

Adım 7 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

8

Adım 8 Add the action to the vService

The action is selected in the Actions field under Details. Actions are processed in the order in the list; the actions after the one that blocks the request do not run (action ordering).

9

Adım 9 Save

Save is clicked; the rule is applied without a separate deployment step. The action does not run unless it is added to the vService. In a cluster setup, the change is also sent to the peer device automatically with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1BlockingClient side

A request is sent from an address in the blocked country (on L7 TCP, a connection is made with nc -v).

Command: curl -sI https://www.example.com/

ExpectedHTTP/1.1 403 Forbidden

The same request from an allowed source receives the normal response (e.g. 200). On L7 TCP, Reject closes the connection, and Silent Drop does not respond.

2Action HitsTR7 side

If the Hit Counter is on, the Action Hits tab on the vService Dashboard is checked; on an HTTP vService, the blocked requests appear with the 403 status code on the HTTP Logs screen.

ExpectedThe action's counter increases

Method 2: L7 DDoS Protection → Country Control

• How it works On the L7 DDoS Protection card, in the Country Control block, a rule line whose Limit field is left empty becomes a membership rule: the action is applied directly to every request coming from the selected countries. The lines are evaluated from top to bottom; the first matching line makes the decision.
• Where it is opened Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → L7 DDoS Protection → Country Control
• Requirement Bot/DDoS license; L7 DDoS & Threat Protection on in the vService; L7 DDoS Protection Active
• vService type HTTP · L7 TCP (on L7 TCP, the action can be Silent Drop or Bandwidth limit)

Step-by-Step Configuration

1

Adım 1 Turn on Bot/DDoS protection (if needed)

If the protection is not on in the vService, the L7 DDoS & Threat Protection box under Details in the vService edit form is checked and Save is clicked (two ways). When the protection is turned on, L7 DDoS Protection starts in Monitor mode and IP Reputation Protection in Active mode (starting modes).

2

Adım 2 Open the L7 DDoS Protection edit window

On the Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management tab, the Edit link of the L7 DDoS Protection card is clicked.

3

Adım 3 Set the protection to Active and save

DDoS Protection = Active is selected and Edit is clicked. In Monitor mode, the rules only generate events; traffic is not blocked.

4

Adım 4 Open the Country Control window

The pencil icon at the top right of the Country Control block on the L7 DDoS Protection card is clicked; the Edit - Country Control window opens (Edit screen).

5

Adım 5 Add the rule line

In the Rules field, + Add is clicked; the line opens with the values Each remaining (individually), Request, limit 2000 and Block.

6

Adım 6 Fill in the row

Match = In set (block those in the list) or Not in set (allow only those in the list) is selected, and the countries are checked in the Countries field. The value in the Limit field is deleted; the label becomes Limit (empty = direct action on every match). Action = Block (Response status code default 403) is selected; on L7 TCP, Silent Drop is selected. For countries that must not be blocked, Exempt Countries can be used.

7

Adım 7 Save

Edit is clicked; the setting is applied without a separate deployment step.

Verification

1Event recordTR7 side

On the Bot/DDoS Event Logs screen, a record is selected; the L7 DDoS tab of the preview is checked.

ExpectedBlocking record originating from Country Control

2BlockingClient side

A request is sent from an address in the blocked country.

Command: curl -sI https://www.example.com/

ExpectedHTTP/1.1 403 Forbidden

Method 3: Network → Firewall (Country)

• How it works At the network layer, traffic coming to a specific port is dropped according to the source country. User Firewall rules are evaluated before the permissions generated automatically for vService listening ports (rule evaluation order).
• Where it is openedNetwork → Firewall → Add
• Requirement Firewall edit permission
• vService type HTTP · L7 TCP (independent of the vService, per route table)

Step-by-Step Configuration

1

Adım 1 Open the rule form

On the Network → Firewall screen, Add is clicked (how to add).

2

Adım 2 Define the rule

Route Table (default DEFAULT; the route table of the vService), Interface, Protocol = TCP and Destination port = the vService port are selected. Source = Country is selected; the field comes filled with Local Networks, and the desired country is selected in its place. For "only this country", the switch next to the field is set to is false. Rule = DENY is selected.

3

Adım 3 Save

The rule is saved and applied immediately; the new rule is added to the bottom of the list and, if necessary, is moved up with Order.

Management access

A DENY rule whose scope is kept broad (e.g. Protocol = All) can also drop management traffic; the rule is kept narrow with Destination port, and a second management session is kept open while it is applied (best practices).

Verification

1ConnectionClient side

A connection is made to the vService port from an address in the blocked country.

Command: nc -vz -w 5 203.0.113.10 443

ExpectedThe connection times out

Method 4: WEB-CLI

• How it works The condition, action and binding in Method 1 are done with WEB-CLI commands.
• Where it is opened WEB-CLI → lb condition · lb action · lb service
• Requirement WEB-CLI access
• vService type HTTP (example with the Block action)

Step-by-Step Configuration

1

Adım 1 Create the condition

The country is written with its two-letter code (condition criteria):

lb condition add criteria src_ip srcIpType country country RU --name ulke-ru

2

Adım 2 Get the condition ID

The --cond field takes the ID of the condition, not its name. The ID is read from the list:

lb condition list

3

Adım 3 Create the Block action

The ID from step 2 is written in place of <condition-id> (action examples); the Status code default is 403:

lb action add type deny name ulke-engeli --cond <condition-id>

Multiple country conditions are written in the form --cond '<id-1> or <id-2>', and the "only this country" rule in the form --cond '!<id>'.

4

Adım 4 See the existing actions of the vService

lb service show <vService>

The rules.0, rules.1 … lines in the output are the actions defined on the vService.

5

Adım 5 Add the action to the first empty position

--rules.N replaces the existing action at that position; therefore, the new action is written to the first empty position. If the vService has no actions, the position is 0; if it has two actions, --rules.2 is used:

lb service update id <vService> --rules.0 ulke-engeli

Verification

1BindingTR7 side

The vService record is displayed again.

Command: lb service show <vService>

Expectedulke-engeli in the rules lines

A request made from the blocked country receives 403, as in Method 1.

Common Mistakes

• Not defining Trusted proxy while TR7 is behind a CDN or proxy. The condition evaluates the country of the proxy's address; on an HTTP vService, the real client IP is first resolved with Trusted Proxy. The Firewall rule, on the other hand, always looks at the source address of the connection.
• Leaving Country Control in Monitor mode. In Monitor mode, the rules only generate events; for blocking, DDoS Protection = Active is set.
• Forgetting local networks in an "only Turkey" rule. Internal network and monitoring traffic is also counted as outside the country; a second condition is created with the Local Networks entry at the top of the Country list, and its negated form is added to the same group with and (in Country Control, Local Networks is added to the Not in set list).
• Adding Block without a condition. A Block action whose Conditions field is left empty blocks all traffic.
• Writing the condition name in the --cond field in WEB-CLI. The field expects the ID of the condition; the ID is taken with lb condition list.
• Overwriting the existing action with --rules.0 in WEB-CLI. An action written to an occupied position replaces the action there; first, the first empty position is found with lb service show.
• Assuming that the location is always correct. For mobile and VPN users, the country information can be misleading; the geographic database is kept up to date with the IP DB package.

How it is done in the documentation

• Source IP · Country
• Block · Scenario 10: Blocking High-Risk Countries
• Country Control · The Fields of the Rule Row
• Firewall · Country
• WEB-CLI · Examples

Related questions

• Can I route clients to a different backend based on their country / city?
• Can I block by ASN?
• Can I block specific IPs/CIDRs or allow only them?