Block traffic originated from specific sub regions in Ukraine to our domain

[spotu]

What is the name of the domain?

barges.co

Additional information

I don’t know/other

What is the issue you’re encountering

What kind of WAF rule can be configured to block such traffic?

What steps have you taken to resolve the issue?

Blocking individual IPs on a case-by-case basis, however we would like to block incoming traffic from specific regions within Ukraine.

What are the steps to reproduce the issue?

N/A

Does this syntax look right?

[fritex]

@spotu

would like to block incoming traffic from specific regions within Ukraine

You could give it a try using below link:

• https://www.maxmind.com/download/geoip/misc/region_codes.csv

Find the region first, then use ip.src.region or ip.src.region_code.
Make sure to have it as and with the ip.src.country as it might be in multiple countries the same region.

You have to use Expression builder for this case. I haven’t tested this yet.

Example (if region Kyiv and Country Ukraine then block):

Helpful article:

Standard fields | Fields reference · Cloudflare Ruleset Engine docs

For the stated ip.src.subdivision_1_iso_code you’d have to be on a higher paid plan type for your zone as follows: