Geographic Access Restriction

Business requirements, license agreements, or compliance rules may require restricting access from certain geographies.

What does HEIMWALL do automatically?

For every request, the Country, ASN Number, and IP Infrastructure Type fields are automatically detected — this data is available without writing any rule. When WAF proxy is enabled, visitors are also automatically routed to the nearest edge node, reducing latency with no extra configuration. The rules below let you define an access policy based on that geographic information.

Basic Rules

# Allow access only from specific countries
IF   ip.country not_in TR, DE, GB, US
THEN block

# Block access to the admin panel from specific countries
IF   ip.country in CN, RU, KP
AND  http.request.base_uri has_prefix /admin
THEN block

With these selections in the console:

• Block outside allowed countries — Field Country · Operator not in list · Value TR, DE, GB, US → Action Block
• Block admin access from high-risk countries — Field Country · Operator in list · Value CN, RU, KP AND Field Path (without query) · Operator starts with · Value /admin → Action Block

Blocking every request outside your allowlisted countries is the strictest form of geographic restriction. It is appropriate for services where licensing or legal compliance requirements apply. Keeping the list current is important; a single missing country can block legitimate access.

Blocking admin panel access only from high-risk sources adds a targeted security layer without restricting general access. This approach suits teams with a global user base who want to limit administrative functions to specific regions.

Advanced Variant

# Graduated filtering from restricted regions with CAPTCHA
IF   ip.country in RU, BY, IR
AND  waf.bot_score ge 40
THEN captcha

# Route traffic to a different content origin based on country
IF   ip.country in US, CA
THEN backend us-east

With these selections in the console:

• Restricted region + bot score CAPTCHA — Field Country · Operator in list · Value RU, BY, IR AND Field Bot Score (0–100) · Operator greater or equal · Value 40 → Action CAPTCHA
• Route by country to a backend — Field Country · Operator in list · Value US, CA → Action Change Backend (us-east)

Combining country with bot score rather than blocking a country outright reduces the false-positive rate. Legitimate users from those countries can solve the CAPTCHA, while automated tools generally cannot.

The backend action routes the request to a different origin server based on the visitor’s geographic location. This reduces latency and simplifies content localization.

Tips

• Start with CAPTCHA or JS Challenge instead of outright blocking; some users may be accessing via VPN
• Add an ASN Number condition alongside Country for more precise targeting
• Be mindful of data processing from EU countries for GDPR compliance