RdpGuard GeoIP Blocking

• GeoIP blocking overview
• Enable GeoIP blocking
• Block selected countries
• Allow selected countries
• Allow specific IP addresses and ranges
• Advanced GeoIP settings
• Known restrictions and limitations

RdpGuard GeoIP blocking lets you deny access from selected countries or allow access only from selected countries. Country IP ranges are updated automatically.

Use Advanced GeoIP settings to apply country restrictions to all ports or selected ports on your Windows server.

1. Click Tools, Options:

   

2. In the Options dialog, select the GeoIP tab and check Enable GeoIP:

   

3. Choose whether to block selected countries or allow selected countries, then follow the steps below for that mode.

In Deny mode, GeoIP blocks the countries you select. It does not restrict other countries.

1. Select Deny connections from selected countries:

   

2. Click Add.

   The Add countries dialog will open:

   

3. Select the countries you want to block and click Add.

4. Click Save in the Options dialog to apply your changes.

In Allow mode, GeoIP allows the countries you select and blocks other countries. You can also add specific IP addresses and ranges as exceptions.

1. Select Allow connections only from selected countries:

   

2. Click Add, Allowed country.

   The Add countries dialog will open:

   

3. Select the countries you want to allow and click Add.

4. Click Save in the Options dialog to apply your changes.

Test mode enforces country restrictions until the next system restart. Restarting the computer removes these temporary GeoIP restrictions. Other firewall and RdpGuard rules still apply.

In Allow mode, add IP addresses, ranges or CIDRs that should be allowed regardless of the selected countries. These entries bypass GeoIP country restrictions, but can still be blocked by RdpGuard's failed-login protection or blacklist.

To exclude a trusted address from RdpGuard blocking, use the whitelist.

1. Click Add, Allowed address or range:

   

2. The Add IP addresses dialog will open:

   

   Enter one or more addresses or ranges, one per line, and click Add.

3. The entries will appear as Custom allow list:

   

   Click Save to apply your changes.

On the GeoIP tab, click Settings:

The Advanced GeoIP settings dialog has three tabs: Deny mode, Allow mode and Miscellaneous.

Deny mode

The Deny mode tab controls which ports are blocked for countries listed in Deny mode.

Blocking scope - choose which ports are denied for blocked countries:

• Block all ports - deny access from blocked countries to all ports on the server.
• Block all ports except selected - deny access from blocked countries to all ports except those listed.
• Block selected ports only - deny access from blocked countries only to the ports listed.

Separate multiple ports with commas, for example: 3389,443.

Allow mode

The Allow mode tab controls which ports are available to allowed countries and which ports are blocked for other countries in Allow mode.

Allow rules - choose which ports are available for allowed countries:

• Allow access to all ports - allow connections from allowed countries to all ports.
• Allow access to selected ports only - allow connections from allowed countries only to the ports listed.

Other connections - choose which ports are denied for countries outside the allowed list:

• Block all ports - deny all access from disallowed countries.
• Block all ports except selected - deny access from disallowed countries to all ports except those listed.

Separate multiple ports with commas, for example: 3389,443.

Exceptions and special networks - additional Allow mode options:

• Allow loopback connections (recommended) - allow connections within this computer. Disabling this option can disrupt applications.
• Allow local network connections - allow access to the server over the local network.
• Exclude VPN networks and Tor exit nodes from allowed connections - exclude known VPN networks and Tor exit nodes from the allowed IP ranges.
• Exclude data center networks from allowed connections - exclude known data center networks from the allowed IP ranges.

Miscellaneous

The Miscellaneous tab contains GeoIP database settings:

Two versions of the GeoIP database are available:

• Lite - fewer IP ranges, lower system load, less precise.
• Max - more IP ranges, higher system load, more precise.

Click OK, then Save in the Options dialog to apply your changes.

GeoIP filtering adds country IP ranges to Windows Filtering Platform (WFP). A country can contain thousands of ranges. Large configurations can increase memory and CPU usage, slow down rule updates and affect network performance.

Avoid filtering individual ports with large country lists.

When country rules apply to selected ports, RdpGuard creates separate TCP and UDP filters for each port. The same country IP list is repeated in each set:

Filtering fewer ports does not mean fewer firewall rules. This multiplication applies both when blocking countries and when allowing them. "All ports except selected" also creates additional filters for the remaining port ranges.

To keep the configuration manageable:

• Consider the Lite database as a performance trade-off. It uses fewer IP ranges, but country detection is less accurate. This can cause addresses to be blocked or allowed incorrectly. Use it only if lower resource usage is more important than accurate country filtering.
• Prefer All ports when it matches your access requirements.
• If access is needed from only a few countries, consider Allow mode instead of blocking a long list of countries.

Test large configurations under representative traffic before using them in production. If performance deteriorates after enabling GeoIP or adding port restrictions, reduce the configuration and retest before expanding it.