Geo-blocking
Geo-blocking looks at where a visitor comes from: their country, and the network their address belongs to. A regional shop can stay open only to the countries it delivers to. A site that gets most of its attacks from a few countries can shut those countries out, and any site can block the cloud networks that nearly all scripted traffic runs on.
Turn it on in the site’s settings: Advanced tab, Geo-blocking. Blocked visitors get a 404 or your own block page.
The GeoIP databases
Geo-blocking uses MaxMind databases in .mmdb format. WardPane reads them from /var/lib/wardpane/geoip (the GEOIP_DIR setting in .env).
- Country database: GeoLite2-Country or GeoLite2-City (or the commercial GeoIP2 versions). Needed for country rules. If both a City and a Country file are present, City is used.
- ASN database: GeoLite2-ASN. Needed for the hosting network rule and for AS numbers.
install.sh copies any .mmdb files it finds next to itself or in a ./maxmind/ folder. You can also drop the files into the folder yourself: the panel looks for new or changed files every 10 minutes and logs each database it loads.
Automatic updates
With a free MaxMind account, WardPane keeps the databases up to date by itself. Create a license key in your MaxMind account, then enter the account ID and the key in Settings > Integrations, or set them in /opt/wardpane/.env:
MAXMIND_ACCOUNT_ID=123456
MAXMIND_LICENSE_KEY=your_license_key
The panel checks once a day and downloads a database again when the copy on disk is older than 7 days. By default it updates the country database you already have (City if a City file is installed, otherwise Country) plus ASN. MAXMIND_EDITIONS chooses the editions explicitly. A downloaded file that cannot be read never replaces a working one.
City or Country and memory use
The City database holds about 100 MB in memory. On a server with 512 MB of RAM use GeoLite2-Country instead (about 10 MB). Blocking only needs the country, so you lose nothing.
Without a country database, country rules do not apply, and the panel shows a warning in the Geo-blocking section. The language filter works without any database.
Denied or Allowed
| Mode | Effect |
|---|---|
| Denied | Block the selected countries, let everyone else in. |
| Allowed | Let in only the selected countries, block everyone else. |
“Allowed” needs at least one country, otherwise the whole world would be blocked; the panel refuses to save such a rule.
Add countries by typing a name or a two-letter code and pressing Enter; they appear as chips. The country is determined from the visitor’s real IP address, also behind Cloudflare when that switch is on.
Groups of countries
Instead of picking dozens of countries one by one, add a group. There are 27 groups.
Organisations:
- Former USSR (all 15 former Soviet republics, Baltic states included)
- CIS, current and former members (including Georgia and Ukraine, which left, Moldova, which is leaving, and the associate Turkmenistan)
- Eurasian Economic Union
- CSTO (Armenia has frozen its participation but is still a member)
- European Union
- European Economic Area (the EU plus Iceland, Liechtenstein and Norway)
- Schengen Area
- NATO
- Five Eyes
- G7
- G20 countries (the member countries; the EU and the African Union are not countries)
- OECD
- BRICS (full members; Saudi Arabia has not confirmed its membership and is not included)
- Shanghai Cooperation Organisation
- ASEAN
- Gulf Cooperation Council
- Arab League
- Mercosur (full members; Venezuela is suspended and not included)
Regions:
- Middle East
- Latin America
- Europe
- Asia
- Africa
- North America (including Central America and the Caribbean)
- South America
- Oceania
- Antarctica
Membership is as of October 2026. The continents follow the UN geoscheme with the usual adjustments: Russia and Cyprus in Europe, Turkey and the Caucasus in Asia. Each group’s hint in the panel explains the disputed cases.
A site stores a reference to the group and does not copy its countries. When a panel update changes a group (a country joins or leaves), your rule picks up the change automatically.
Exceptions and the effective list
Exceptions are countries the rule never applies to, even if a group or your own picks include them. For example:
- Denied, group “CIS, current and former members”, exception Kazakhstan: block the CIS except Kazakhstan.
- Allowed, group “European Union”, exception Hungary: let in only the EU, without Hungary.
Below the lists, the panel shows the effective list: exactly which countries the rule covers once your countries, the groups and the exceptions are combined. If the exceptions remove everything in “Allowed” mode, the panel tells you.
Visitors whose country is unknown
Some addresses are in no database, such as brand-new allocations and reserved ranges. By default they are let in. Tick Block visitors whose country can’t be determined to block them. This applies in both modes.
Hosting and cloud networks
Block hosting & cloud networks blocks visitors from the big hosting and cloud providers. Real people rarely browse from a data center, while scripts, scanners, scrapers and many VPNs run there. The list covers Amazon AWS, Microsoft Azure, Google Cloud, Oracle Cloud, IBM Cloud, Alibaba Cloud, Tencent Cloud, Huawei Cloud, DigitalOcean, Hetzner, OVH, Akamai/Linode, Vultr, Contabo, Scaleway, Leaseweb, M247, Datacamp/CDN77, Hostinger, Selectel, Timeweb, Hostkey, FranTech/BuyVM, Psychz and Aeza.
This needs the ASN database. It applies in both Denied and Allowed mode, on top of the country rule. Search engines, link preview bots and your own monitoring may run in these networks too. If you need them, check the effect in the statistics, or allow their addresses in the site’s allow list.
AS numbers
Also block networks (AS numbers) takes your own list of networks, written as AS12345 or 12345, separated by commas or one per line. Use it for a provider whose addresses keep attacking your site. It needs the ASN database.
The order inside Geo-blocking
- The browser language (cheapest check, needs no database).
- Hosting and cloud networks.
- Your AS numbers.
- Unknown country.
- The country rule (Denied or Allowed).
Addresses in the site’s allow list skip all of it. If a site is proxied by Cloudflare but not marked “Behind Cloudflare”, every request arrives from a Cloudflare address, which says nothing about the visitor. Country and network checks are skipped for such requests, and only the language filter still works.
Looking up an IP
At the bottom of the Geo-blocking section, type an address (for example 8.8.8.8) and press Look up. The panel shows its country, its network (AS number and name) and whether it counts as a hosting network. This is a quick way to test a rule before you rely on it.
Rolling back to an older version
Groups and exceptions appeared in version 1.4.0. The effective list of countries is also saved in the field that older versions read, so if you roll back below 1.4.0, the site keeps blocking exactly the same countries. You cannot edit groups there. If you change the rule in the old version and then update again, its list of countries is kept and the groups and exceptions are removed, with a note in the activity log.