Geo location rule not working as expected

Hi Nancharaiah Konatham,

I can see that you have created a custom WAF rule to block non-US traffic. However, the WAF is still blocking requests that appear to originate from US IP addresses.

Could you please verify in the WAF logs whether the requests are actually originating from the United States or from a different geographic location? This will help determine whether the geo-location rule is functioning as expected or if another rule is causing the traffic to be blocked

To check the logs, if Diagnostic Settings are not currently configured, you can enable them and send the logs to a Log Analytics Workspace. Once enabled, you can review the WAF logs to determine whether the requests are originating from the US or from another geographic location.

Check the Client IP Seen by Front Door using the below KQL Query.

AzureDiagnostics 
| where Category == "FrontDoorWebApplicationFirewallLog" 
| project clientIP_s, ruleName_s, action_s

Take a blocked US IP and verify its geolocation using:

• ipinfo.io
• whatismyipaddress.com
• MaxMind GeoIP

Sometimes the IP is registered to another country even though the user is physically in the US.

If users are using: Corporate VPN, the Front Door evaluates the source IP reaching Front Door, not the user's local workstation IP.

Example:

User in Texas----->Corporate VPN Exit Node (Germany)----->Azure Front Door, Front Door sees Germany and blocks it.

Pleaseand “up-vote” wherever the information provided helps you, **this can be beneficial to other community members.