Country Block

Country Block

🌐 English · Français

Per-route geographic filtering using the MaxMind GeoLite2-City database. Allow-list or deny-list any combination of ISO 3166 country codes for any route.

Use when : your homelab's intended audience is geographically bounded (e.g. France-only family services) and you want to drop traffic from outside the bubble before it ever reaches the WAF or your backend.

---

Quick start

1. Sidebar → Routes → click your route → Edit
2. Expand the Pays bloqués (Country Block) section
3. Pick a mode :
   • Désactivé (off) — default, no filtering
   • Allow — only the listed countries can access
   • Deny — the listed countries are blocked, everyone else passes
4. Type a country name in the autocomplete (e.g. France, Brazil) — picks resolve to ISO codes (FR, BR) ; each suggestion and chip shows the country's flag (v2.22.0)
5. Click each entry to add it to the chip list ; click the chip's ✕ to remove
6. Save

Within 5s the country filter is active. Requests from blocked countries get 403 Forbidden with the route's branded error page (or the default Arenet error page).

---

Continents and exceptions (v2.27.0)

How the lists combine. Continents, countries and networks (ASN) are three optional lists joined by OR: a request matches as soon as its continent, OR its country, OR its network is in one of them. Fill only the ones you need — one is enough. In deny mode, exceptions always pass, before anything else. Since v2.34 a sentence at the top of the section states the rule live (e.g. "Blocked if the visitor comes from Asia or Russia or AS14061 — except Japan").

The section is now called Geo filtering. Next to countries you can:

• Tick continents (Europe, Asia, Africa, North America, South America, Oceania, Antarctica). A continent counts exactly like a country in the list: in Deny its visitors are blocked, in Allow only listed countries and continents get through.
• In Deny mode, add exceptions: countries that are always allowed, even inside a blocked continent — e.g. Deny Asia, except Japan.

Setup	Tokyo	Beijing	Paris	New York
Deny Asia	403	403	✓	✓
Deny Asia, exception Japan	✓	403	✓	✓
Allow Europe	403	403	✓	403

Rules: exceptions exist only in Deny mode (the API rejects them otherwise), a country can't be both blocked and an exception, and an Allow list needs at least one country or continent. The continent comes from the same GeoLite2-City database — nothing extra to install. Blocked requests are logged with the resolved country, as before.

---

ASN networks (v2.28.0)

An ASN (autonomous system number) identifies a network operator: an ISP, a cloud or a hosting provider (AS14061 DigitalOcean, AS16276 OVH, AS15169 Google…). Blocking by ASN catches a provider's whole address space in one rule — handy against scanners and bots running from cloud VPSes.

• The ASN block of the Geo filtering section searches by name or number (ovh, digital, 16276, AS16276). ASNs count like countries and continents in both modes.
• In Deny mode, Exception networks (ASN) are always allowed — e.g. deny Europe except AS29518, or deny DigitalOcean except the AS of your own VPS provider.
• ASN data comes from a second MaxMind database, GeoLite2-ASN (free, same account and license key). With Settings → GeoIP configured, Arenet downloads and refreshes it together with the City database; manual setups can drop GeoLite2-ASN.mmdb next to the City file (or set ARENET_GEOIP_ASN_MMDB).
• Without the ASN database the other rules keep working; ASN rules simply don't match, and an Allow list that relies on ASNs lets traffic through rather than blocking everyone (fail-open, like a missing GeoIP database). The form shows a hint when the database is missing.

---

When to use Allow vs Deny

Strategy	Best for
Allow (whitelist)	Personal / family services, home automation, internal admin tools — your audience IS geographically bounded
Deny (blacklist)	Public services with global audience but specific known-bad regions you want to drop

Allow is safer (default-deny posture). Deny is more permissive but easier to maintain (no risk of accidentally locking yourself out when traveling — just add your transient country temporarily).

---

How country resolution works

For each request :

1. Get the source IP (after X-Forwarded-For trust if configured)
2. Look up the IP in the MaxMind GeoLite2-City DB
3. Match the resolved country code against the route's allow/deny list
4. Decision : pass-through or 403

The MaxMind DB is operator-supplied, not embedded in the binary : Arenet reads it from the path in ARENET_GEOIP_MMDB (default /var/lib/arenet/GeoLite2-City.mmdb). Once loaded, lookups are local — no external API call, no per-request network cost. See Settings → GeoIP below for how to get the file in place, including auto-download.

---

What gets blocked

The block fires before WAF and reverse-proxy handlers in the chain. A blocked request :

• Returns 403 Forbidden
• Emits a decision_event row (visible in /security/decisions)
• Does NOT count against rate limits (it never reaches them)
• Does NOT show up in WAF events (it never reaches Coraza)

---

Edge cases

Unknown IP (private, reserved, CGNAT)

MaxMind's GeoLite2 doesn't cover private (RFC1918), reserved, or CGNAT IPs. For these, the country code resolves to "" (empty).

Allow mode : empty country is rejected (the IP isn't in the allow list). Useful behaviour for public routes — private-range IPs reaching a public route is suspicious.

Deny mode : empty country is passed through (not in the deny list).

If your route is meant for LAN-only access AND you want to allow private ranges in Allow mode, the workaround is to bind that route to a specific listener on the LAN interface only (advanced, not UI-exposed). The standard pattern is to keep LAN-only routes off the public listener entirely.

IPv6

Fully supported — MaxMind GeoLite2 covers IPv6 ranges.

Anonymous proxies / VPNs

MaxMind's free GeoLite2 doesn't flag anonymous proxies. If you need this, the paid MaxMind GeoIP2 Anonymous IP DB integrates separately (not currently exposed in Arenet UI ; manual config required).

For most homelab use cases, layering Country Block + CrowdSec (which DOES flag known VPN exit nodes via community scenarios) gives you ~90% of the value of a paid anonymous-IP DB.

---

Observability

Every blocked request emits a decision_event with origin=country_block. The /security/decisions page filters these. The unified /logs shows them with the COUNTRY badge.

The dashboard's GeoIP World Map visualizes the live distribution of blocked-by-country traffic — useful for understanding what your routes are seeing without diving into individual events.

---

API reference

# Update a route's country block via API
curl -b /tmp/jar -X PUT -H "Content-Type: application/json" \
  -d '{
    ...other route fields...,
    "countryBlock": {
      "mode": "allow",
      "countryList": ["FR", "BE", "CH", "LU"]
    }
  }' \
  http://localhost:8001/api/v1/routes/<route-id>

Available modes : "off" (or empty), "allow", "deny". Country codes are 2-letter ISO 3166-1 alpha-2, uppercase.

---

Updating the GeoLite2 database

The database is operator-supplied, not embedded in the Arenet binary. Arenet reads it from ARENET_GEOIP_MMDB (default /var/lib/arenet/GeoLite2-City.mmdb) — you're responsible for putting a .mmdb file there and keeping it fresh.

The easiest way to do that is Settings → GeoIP : enter your free MaxMind account ID + license key, then either enable weekly auto-update or click Update now to download/refresh the database immediately. Arenet stores the credentials, downloads the DB to the configured path, and reloads it without a restart.

If you'd rather manage the file yourself (no MaxMind account, air-gapped host, etc.), drop a GeoLite2-City.mmdb at the configured path manually — Arenet picks up changes to that file without needing the auto-update feature configured.

---

See also

• Routes — where to find the Country Block section in the UI
• CrowdSec — community IP reputation, layered with country blocking
• WAF — layer 7 attack detection after country + CrowdSec pass-through
• MaxMind GeoLite2 — the upstream database
• internal/countryblock/ — Arenet's implementation
• internal/geo/ — MaxMind reader (hot-swappable) + IP lookup