Block traffic from specific countries

This example custom rule blocks requests based on country code using the ip.src.country field.

• When incoming requests match:

  Field	Operator	Value
  Country	is in	Korea, North, Syria

  If you are using the expression editor:
  (ip.src.country in {"KP" "SY"})

• Then take action: Block

• Use case: Block traffic by geographical location
• Use case: Allow traffic from specific countries only