> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-configure-geoip-to-block-or-allow-countries.md).

# How to Configure GeoIP to Block or Allow Countries on Your Servers

GeoIP lets you decide from which countries traffic to **public IPs** of your services is allowed or blocked.

It is a simple way to reduce the attack surface when legitimate traffic should only come from specific regions.

> #### 👍 What you get
>
> Control access to your services by country of origin, for each public IP, with a one-click return to the default state.

### What it is for

* **Security**: block regions from which you only receive attacks.
* **Simplicity**: country-based rules, without having to maintain IP lists by hand.
* **Compliance**: apply country-based restrictions if your client requires it (for example, GDPR or sector-specific requirements).
* **Flexibility**: different policies per server or per network depending on the case.

### How it works

GeoIP combines two layers:

* **Perimeter layer**, at the edge of the infrastructure: filters traffic by country. This is where the default global policy lives (the list of blocked countries).
* **Your subscription's network layer**: controls the ports and protocols of **Ingress/Egress** within your network. It does not filter by country.

From GeoIP, for each public IP you choose the **blocked countries**: checked means **Deny** and unchecked means **Allow**, unless that country was already blocked by the global policy. If you allow a country that the global policy blocks, an *allow*type exception is created; if you block one that the global policy does not block, a *deny* rule of your own is created.

> #### 🚧 GeoIP does not open ports
>
> GeoIP filters by country at the perimeter layer, but does not touch the ports. If the port or protocol is still closed in your Ingress/Egress rules, traffic will not get through even if you allow that country.

### Before you start

* Log in to the Plenit panel.
* Have administrative permissions over **Servers**.
* The network you are going to work on must have at least one **public IP**.

### Step 1. Access GeoIP

1. In the panel, open **Services → Servers**.
2. In the side menu, go to **Firewall**.
3. Open the **Geolocation**.

{/\* 📸 CAPTURE 1 · Firewall menu with the Geolocation tab \*/}

![Access to the Firewall Geolocation tab](https://REEMPLAZA-URL/servidores-howto-geoip-01.png)

### Step 2. Select the network

At the top, use the **Network selector** to choose where to apply GeoIP. You will see the list of public IPs and how many countries each one has blocked.

> #### 📘 145 countries blocked by default
>
> It is common to see 145 countries blocked at the start. That number may include regions within a country, so it does not always represent the whole country as a single filtering unit.

{/\* 📸 CAPTURE 2 · Network selector and list of public IPs with their country count \*/}

![Network selection and list of public IPs](https://REEMPLAZA-URL/servidores-howto-geoip-02.png)

### Step 3. Review the public IPs and enter edit mode

In the table you can see each public IP, its number of blocked countries, and the **Edit**. Click **Edit** on the IP you want to adjust.

{/\* 📸 CAPTURE 3 · table of public IPs with the Edit action \*/}

![Table of public IPs with the edit option](https://REEMPLAZA-URL/servidores-howto-geoip-03.png)

### Step 4. Manage the countries

Use the continent and country selector. **Checked = blocked**; **unchecked = allowed** (except for global blocking). You have **Save**, **Restore configuration** and **Cancel**.

{/\* 📸 CAPTURE 4 · country selector by continent \*/}

![Country selector to block or allow](https://REEMPLAZA-URL/servidores-howto-geoip-04.png)

### Step 5. Confirm and apply

Click **Save**, review the summary and click **Confirm**. The changes are synchronized with the infrastructure: it is not immediate, it takes a few minutes.

{/\* 📸 CAPTURE 5 · summary of changes and Confirm button \*/}

![Summary and confirmation of GeoIP changes](https://REEMPLAZA-URL/servidores-howto-geoip-05.png)

### Step 6. Verify the result

Check the counter of **blocked countries** on the edited IP and do access tests if needed. For a quick check from a source in the country you want to validate:

```bash
curl -I http://<PUBLIC-IP>
```

Since filtering depends on the country of origin, to test a blocked country you need to connect from that country (for example, through a VPN in that region). If you need to start from scratch, use **Restore configuration**.

### Practical cases

| Case                              | What you do                                                          |
| --------------------------------- | -------------------------------------------------------------------- |
| Allow only Spain and Portugal     | Check all countries, uncheck Spain and Portugal, **Save → Confirm**  |
| Allow Canada temporarily          | Uncheck Canada, **Save → Confirm**; when you're done, check it again |
| You don't know the current status | **Restore configuration** and start clean from the global policy     |

### Usage tips

* **Less is more**: block first and open only what is essential.
* **Standardize**: apply the same base policy to several IPs and document the exceptions.
* **Use Restore** as a reset when you do not know what rules are applied.
* **Remember the network layer**: if the port or protocol is closed in Ingress/Egress, traffic will not get in even if you allow the country.

### If something does not fit

| Symptom                                        | Likely cause                                 | What to do                                              |
| ---------------------------------------------- | -------------------------------------------- | ------------------------------------------------------- |
| The Confirm button is disabled                 | There are no changes to apply                | Make some change or leave with Cancel                   |
| I allowed a country but it still does not work | Propagation is missing or the port is closed | Wait a few minutes and review your Ingress/Egress rules |
| I blocked too much and lost access             | Policy too restrictive                       | Use **Restore configuration**                           |
| I don't see the Geolocation tab                | The view is not available in your panel      | Contact Partner Success so they can enable it           |

### Conclusion

GeoIP gives you a simple security lever: you decide by country who reaches your public IPs, without maintaining address lists by hand and with a reset button whenever you need it.

The golden rule is to remember that it acts only on the country of origin: you still control the ports and protocols in the Ingress/Egress rules, so GeoIP adds to that layer, it does not replace it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-configure-geoip-to-block-or-allow-countries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.