Configuring IP/Geo Firewall Rules

Reading time: About 5 minutes
Prerequisites: None

How This Differs from Other Policies

Navigation path: Security Settings > Policies > [Target Hostname] > IP/Geo Firewall

Creating a Block Rule

IP Block

1. Go to Security Settings > Policies > [Target Hostname] > IP/Geo Firewall, and click Add Rule.
2. Select IP Blocking as the rule type, then enter the target to block. The following formats are supported:
   • Single IP: 1.2.3.4
   • IP range (CIDR): 1.2.3.0/24
   • IP range: 1.2.3.1–1.2.3.100
3. Click Save and confirm that the configuration has taken effect.

Usage recommendations:

• A single high-frequency attack IP that appears repeatedly in the attack logs → Single IP blocking
• Attack IPs are concentrated within a specific IP range (sharing the same data center or AS number) → CIDR blocking

Geo Block

1. Go to Security Settings > Policies > [Target Hostname] > IP/Geo Firewall.
2. Select Geo Block as the rule type, then choose the country or region to block.
3. Click Save and confirm that the configuration has taken effect.

Important: Geo blocking affects all users in the selected region, including your legitimate users. Use this only when:

• Your product explicitly does not serve that region
• The proportion of attack requests from that region is extremely high and there are no legitimate users

User experience after blocking: When users in the blocked region try to access your site, they will see the page you configured in Custom Response (a 403 response is returned by default). It is recommended to customize the response page to inform users why the service is unavailable and avoid confusion.

Operational Recommendations

1. Try Threat Intelligence first: Automatically blocks known malicious IPs without manual maintenance
2. Extract attack IPs from attack logs: Check Top Attack Sources and manually add block rules for IPs that are persistently attacking