Geolocation is blocking someone from a country that isn't blocked

kkingkking
in Firebox - Other

Our T80 is configured to block all countries except the US and Mexico. I have a local client trying to access our website, but Geolocation is blocking them with the reason "Blocked country: United States". All of our clients are in the US, but no one else is getting this. Any suggestions?
We added an exception for her IP (even though it is through AT&T in Redmond, WA), but she is still blocked with the same reason.

Answers

  • Bruce_BriggsBruce_Briggs

    Please post a log message from Traffic Monitor showing this

  • james.carsonjames.carson Moderator, WatchGuard Representative

    Hi @kking

    IP addresses get reallocated quite often, so it's likely a false positive.

    If they're making an inbound connection, the log message you see will base the display off the destination IP. In the case of an inbound connection, it'll show the wrong thing.

    If you go into subscription services on your firewall, (subscription services tab in Firebox System Manager, or in the Front Panel of the WebUI) there's a lookup area for geolocation. Look up what IP the customer from AT&T is coming from.

    While I understand the intent of blocking everything but the US/MEX, companies will place servers in the EU to complay with GDPR often. I would suggest blocking countries that you explicitly don't trust vice blocking all and excepting just a few.

    -James Carson
    WatchGuard Customer Support

  • james.carsonjames.carson Moderator, WatchGuard Representative

    In addition to the above, if you can create a support case (use the button on the top right of the page) and paste your log into the case, we can get the geolocation false positive corrected.

    -James Carson
    WatchGuard Customer Support

Sign In to comment.