I decided to try and create a firewall rule to challenge all countries except US and Canada. The expression created is (ip.geoip.country ne “US”) or (ip.geoip.country ne “CA”) and the action is set to Challenge.
I turned the rule on and then checked the log only to see that US IPs are all getting challenged now! I turned the rule off and US IPs are no longer being challenged.
Did I make a mistake in the rule or is it truly not working correctly?