> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-geoip-to-block-or-allow-countries.md).

# How to Configure GeoIP to Block or Allow Countries on Your Servers

GeoIP lets you decide from which countries traffic to **Public IPs** your services is allowed or blocked.

It is a simple way to reduce the attack surface when legitimate traffic should only come from specific regions.

> #### 👍 What you get
>
> Control access to your services by country of origin, for each public IP, with a one-click return to the default state.

### What it is for

* **Security**: blocks regions from which you only receive attacks.
* **Simplicity**: country-based rules, without keeping IP lists by hand.
* **Compliance**: apply country restrictions if your client requires it (for example, GDPR or sector-specific requirements).
* **Flexibility**: different policies per server or per network depending on the case.

### How it works

GeoIP combines two layers:

* **Perimeter layer**, at the edge of the infrastructure: filters traffic by country. This is where the global default policy lives (the list of blocked countries).
* **Subscription network layer**: controls the ports and protocols of **Inbound/Outbound** within your network. It does not filter by country.

From GeoIP, for each public IP you choose the **blocked countries**: checked equals **Deny** and unchecked equals **Allow**, unless the country was already blocked by the global policy. If you allow a country that the global policy blocks, an *allow*-type exception is created; if you block one that the global policy does not block, a *deny* rule of your own is created.

> #### 🚧 GeoIP does not open ports
>
> GeoIP filters by country at the perimeter layer, but it does not touch ports. If the port or protocol are still closed in your Inbound/Outbound rules, traffic will not pass even if you allow that country.

### Before you start

* Log in to the Plenit panel.
* Have administrative permissions over **Servers**.
* The network you are going to work on has at least one **Public IP**.

### Step 1. Access GeoIP

1. In the panel, open **Services → Servers**.
2. In the side menu, go to **Firewall**.
3. Open the **Geolocation**.

{/\* 📸 SCREENSHOT 1 · Firewall menu with the Geolocation tab \*/}

![Access to the Firewall Geolocation tab](https://REEMPLAZA-URL/servidores-howto-geoip-01.png)

### Step 2. Select the network

At the top, use the **Network selector** to choose where to apply GeoIP. You will see the list of public IPs and how many countries each one has blocked.

> #### 📘 145 countries blocked by default
>
> It is common to see 145 countries blocked at the start. That number may include regions within a country, so it does not always represent the whole country as a single filtering unit.

{/\* 📸 SCREENSHOT 2 · Network selector and list of public IPs with their country count \*/}

![Network selection and list of public IPs](https://REEMPLAZA-URL/servidores-howto-geoip-02.png)

### Step 3. Review the public IPs and enter edit mode

In the table you can see each public IP, its number of blocked countries, and the action **Edit**. Click **Edit** on the IP you want to adjust.

{/\* 📸 SCREENSHOT 3 · public IP table with the Edit action \*/}

![Public IP table with the edit option](https://REEMPLAZA-URL/servidores-howto-geoip-03.png)

### Step 4. Manage the countries

Use the continent and country selector. **Checked = blocked**; **unchecked = allowed** (except for global blocking). You have **Save**, **Reset settings** and **Cancel**.

{/\* 📸 SCREENSHOT 4 · country selector by continent \*/}

![Country selector to block or allow](https://REEMPLAZA-URL/servidores-howto-geoip-04.png)

### Step 5. Confirm and apply

Click **Save**, review the summary and click **Confirm**. The changes are synchronized with the infrastructure: it is not immediate, it takes a few minutes.

{/\* 📸 SCREENSHOT 5 · summary of changes and Confirm button \*/}

![Summary and confirmation of GeoIP changes](https://REEMPLAZA-URL/servidores-howto-geoip-05.png)

### Step 6. Verify the result

Check the count of **blocked countries** blocked countries

```bash
on the edited IP and run access tests if needed. For a quick check from a source in the country you want to validate:
```

Since filtering depends on the country of origin, to test a blocked country you need to connect from that country (for example, through a VPN in that region). If you need to start from scratch, use **Reset settings**.

### Practical cases

| Case                              | What you do                                                           |
| --------------------------------- | --------------------------------------------------------------------- |
| Allow only Spain and Portugal     | Mark all countries, uncheck Spain and Portugal, **Save → Confirm**    |
| Temporarily allow Canada          | Uncheck Canada, **Save → Confirm**; when you are done, check it again |
| You do not know the current state | **Reset settings** and start clean from the global policy             |

### Usage tips

* **Less is more**: block first and open only what is essential.
* **Standardize**: apply the same base policy to several IPs and document the exceptions.
* **Use Reset** as a reset when you do not know what rules are applied.
* **Remember the network layer**: if the port or protocol is closed in Inbound/Outbound, it will not get in even if you allow the country.

### If something doesn't match

| Symptom                                        | Likely cause                                 | What to do                                               |
| ---------------------------------------------- | -------------------------------------------- | -------------------------------------------------------- |
| The Confirm button is disabled                 | There are no changes to apply                | Make a change or exit with Cancel                        |
| I allowed a country but it still does not work | Propagation is pending or the port is closed | Wait a few minutes and check your Inbound/Outbound rules |
| I blocked too much and lost access             | Policy too restrictive                       | Use **Reset settings**                                   |
| I do not see the Geolocation tab               | The view is not available in your dashboard  | Contact Partner Success so they can enable it            |

### Conclusion

GeoIP gives you a simple security lever: you decide by country who reaches your public IPs, without keeping address lists by hand and with a reset button when you need it.

The golden rule is to remember that it acts only on the country of origin: you still control the ports and protocols in the Inbound/Outbound rules, so GeoIP adds to that layer, it does not replace it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-geoip-to-block-or-allow-countries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.