Whitelist or blacklist a country

Country policies in cPFence v4+ use two-letter ISO country codes and available IPv4/IPv6 datasets.

Keep country policies limited

Use country allow/block rules judiciously. A small selection, typically two or three countries, avoids unnecessarily large policies. Look up the ISO 3166 country code; it is not a visitor’s guaranteed physical location.

Using the WebUI

Review the country code and access type before confirming. Select the image for full size; use browser Back to return.

1. Open IPDB Firewall & IP Tools, choose one server and select Country Access Control.
2. Click Add country policy, enter Country code, and choose Blocked or Whitelisted.
3. Click Review action, check the server and access type, then confirm.
4. Check the policy and IPv4/IPv6 network counts. To reverse it, open its details and Remove country policy.

For several servers, use the named country actions in Advanced Tools, checking sidebar targets and each result. Support users need country-policy permission.

Using the CLI

As root, substitute the intended two-letter code:

Action	Command
Block country	cpfence --blacklist-country us
Remove country block	cpfence --del-blacklist-country us
Whitelist country	cpfence --whitelist-country us
Remove country whitelist	cpfence --del-whitelist-country us

Country whitelists bypass IPDB protection

Allowing a country is a broad exception. Keep a working root session or provider console before access changes. Use supported controls rather than copying country settings between servers or flushing their firewall state.

A failed dataset refresh retains existing data. For Tor, use a Tor exit-node list rather than a country code.