Firewall rules country block don't seem to work

I have a firewall rule to block certain countries and my Wordfence is telling me that I had a lot of attacks in the past 8 hours from several of these countries. I look in the firewall log and it shows “0” incidents.

Could someone please let me know if I am doing something wrong or am I missing something?

Firewall rule is

Field = Country
Operator = is in and also tried equals
value = country like Ukraine or China

Then = Block

Here is my expression Preview

(ip.geoip.country in {“CN”} and ip.geoip.country in {“RU”} and ip.geoip.country in {“UA”} and ip.geoip.country in {“RO”} and ip.geoip.country in {“KP”} and ip.geoip.country in {“TR”} and ip.geoip.country in {“SK”} and ip.geoip.country in {“IR”} and ip.geoip.country in {“MY”} and ip.geoip.country in {“BR”} and ip.geoip.country in {“VN”})

By the way I looked in my Overview Activity Log and it shows Action Taken Challenge and the Service is Security Level. Im pretty new so I am not sure what all this means. Why is it challenging them instead of blocking?

You need to OR the countries, not AND them. Right now you expect your visitors to be from all these countries at the same time.

Best would be to use is in instead altogether.

(ip.geoip.country in {"BR" "CN" "IR" "KP" "MY" "RO" "RU" "SK" "TR" "UA" "VN"})

Thank you Sandro for helping out a Noob like me! I really appreciate your help, I am updating it right now!

This topic was automatically closed after 30 days. New replies are no longer allowed.