---
layout: article
title: Block traffic by country
description: Create Appwrite Firewall deny rules that block project API traffic from specific countries.
difficulty: beginner
readtime: 4
---

A deny rule with a country condition blocks all matching traffic from that country. Use this pattern to comply with regional restrictions or to stop abuse that comes from one region.

Country conditions use the geo location of the client IP address, and work on every plan. Finer location attributes such as city need the [premium Geo DB addon](/docs/products/firewall/conditions#premium-geo-db).

# Create the deny rule

![Create firewall rule wizard with a country condition](/images/docs/firewall/block-countries.avif)

1. Open **Firewall** in your project.
2. Click **Create rule**.
3. Enter a **Rule name** (for example `Block traffic by country`).
4. Keep **Resource type** set to **API**.
5. Under conditions, set the attribute to **Country**.
6. Keep the operator set to **Equals**.
7. Select the country in the country picker.
8. Under **Then**, choose **Deny**.
9. Keep **Priority** at `100`.
10. Review the impact preview, then click **Create rule**.

Denied clients receive a `403` response. The denied requests appear in [traffic overview](/docs/products/firewall/monitor) under the **Denied** series.

To block more than one country, create one deny rule for each. Conditions on a single rule must all match, and a request comes from one country, so a rule with two **Country** **Equals** conditions never matches anything.

# Allow only specific countries

To serve only specific countries, invert the pattern. Create one deny rule, and add one **Country** **Not equal** condition for each allowed country. A request matches the rule only when its country differs from every allowed country, and the rule denies it.

Traffic whose country Appwrite cannot resolve also matches **Not equal**, so this rule denies it. To let it through, add **Country** **Not equal** `unresolved`. See [When Appwrite cannot resolve a location](/docs/products/firewall/conditions#unresolved-location).

# Verify the rule

1. Send a request from the blocked country with a client SDK or an API key. Use one of those, because Firewall never blocks the Console.
2. Confirm the client receives a `403` response.
3. Open **Firewall** and confirm the **Denied** series rises in the traffic overview.

To pause the rule, turn off its status toggle in the rules list.

[Traffic overview](/docs/products/firewall/monitor)