WAF rule to block traffic not from particular continents incorrectly being applied

[tbyehl]

What is the name of the domain?

example.com

What is the error number?

915ac7f5cb792022

What is the issue you’re encountering

WAF rule to block traffic not from North America, South America, and Europe has been blocking traffic from IPs identified as from countries within those continents.

What steps have you taken to resolve the issue?

Added countries to WAF rule to stop the carnage.

What are the steps to reproduce the issue?

My longstanding rule was: (not ip.geoip.continent in {"EU" "NA" "SA"})

Screenshot of the error

[sjr]

There’s been another similar post today, hopefully someone will take a look soon.

[tbyehl]

Realized I have other domains with that rule, and it has still been happening randomly throughout today.

[tbyehl]

Have seen it more today, here’s another Ray ID: 91a62ba85a985997

[mfamphlett]

I’ve just noticed this same issue with a similar rule:

Block all outside EU: (ip.geoip.continent ne "EU")

It seems to randomly be blocking some connections from within the EU, even from the same IP and within the same session.

Did you find a solution?

[sroberts]

Hey folks!

Thanks for raising this. I’ve located the issue, and a fix should be available within the next couple of working days.