If you’re trying to set up a Web ACL to block all countries except for a few specific ones, it’s important to understand how the rules work in AWS WAF. By default, the Web ACL is set to allow all requests unless you add explicit rules to block or restrict traffic.
I initially tried creating a rule that blocks all countries except for the ones I specified. To do this, I set the rule to check if a request originates from certain countries and added the country codes I wanted to allow. I then set the action to “Block.” However, instead of blocking the countries I didn’t want, the rule ended up blocking the ones I did want.
The trick was in how the condition was set. I realized I needed to change the rule from “If a request originates from a country in” to “If a request does not originate from a country in.” By making this change, the rule now correctly blocks all countries except for the ones I specified.
In simple terms, when setting rules based on countries to block or allow, always double-check whether your rule should match the countries you want to allow or the ones you want to block. Often, creating the rule to match the opposite and then adjusting the action accordingly is the way to go. It can be a bit confusing at first, but with this approach, you’ll get the desired result.