Updated on 2026-09-23 GMT+08:00

Geolocation Access Control Rule Failure

Symptom

After a geolocation access control rule is configured, the expected protection result is not displayed, and the rule does not take effect.

Mind Map for Troubleshooting

Take the following steps to address the issue.

**Table 1** Table 1 Troubleshooting
No.	Probable Cause	Solution
1	The rule has not taken effect yet.	It takes several minutes for a new rule to take effect.
2	The rule configuration is incorrect.	Check whether the protective action of the geolocation access control rule is correctly configured.
3	A false client IP address is obtained.	Check whether the real client IP address is obtained.
4	Impact of other rules	Check whether there are other rules with higher priorities.

Cause 1: The Rule Effective Time Has Not Arrived

After adding, modifying, or deleting a geolocation access control rule, wait for several minutes and then check whether the rule takes effect.

Cause 2: The Rule Configuration Is Incorrect

The geolocation access control rule is incorrectly configured. For example, the expected protective action is block, but the action is incorrectly set to allow. As a result, the expected result cannot be observed. Check whether the rule configuration is correct.

Cause 3: A False Client IP Address Is Obtained

Geolocation access control rules depend on the geographical location of the real client IP address. By default, WAF obtains the real client IP address based on the source IP address of the TCP connection (not the X-Forwarded-For field). If a Layer-7 proxy, such as CDN, is deployed for the website link or the IP address tag is incorrectly configured, the real client IP address cannot be identified. As a result, the geolocation access control rule becomes invalid.

Cause 4: Impact of Other Rules

The global protection whitelist as well as whitelist and blacklist functions has a higher priority than geolocation access control. If there are such rules that allow access from specific IP addresses or IP address ranges, the geolocation access control rule may become invalid. You are advised to check whether such rules exist.

Submitting a Service Ticket

If the problem persists, Submitting a Service Ticket.

Parent topic: Protection Rules