Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Security › GeoIP

GeoIP

GeoIP blocking

SharedStatus: SUPPORTED when a GeoIP database is loadedAudience: security engineer

Purpose

Country-level allow/block using MaxMind or DB-IP MMDB plus Manager rules (GEOIP_BLOCK / GEOIP_ALLOW). Lookup API is admin-only.

Configuration

Manager security.geoip.* — see Manager Configuration. Agent may hold a local DB or pull via GET /api/v1/agent-geoip-database.

allow_on_lookup_failure fail-opens when lookup errors.

Operator path

  1. Load MMDB; enable GeoIP; restart Manager.
  2. GET /api/v1/geoip/settings — database_status should be loaded (probe uses 8.8.8.8).
  3. POST /api/v1/geoip/rules with 2-letter ISO country_code and action block or allow.
  4. POST /api/v1/geoip/lookup {"ip":"203.0.113.10"} for an admin test.

Full API: GeoIP. Setup: GeoIP.

Verification

Rules list; Agent sync blocked_countries / allowed_countries; security logs after enforcement Agents apply policy.

Failure modes

503 lookup service missing; 400 non-ISO country; Agents stale if they cannot pull the DB.

Security

Not an unauthenticated geolocation API. MaxMind license key is a secret. Country blocks are coarse (NAT, CDNs, dual-use).

Limitations

No accuracy SLA. Not a commercial GeoIP Insights product.