> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Blocking Traffic from Countries using Geoblocking

> The Geoblocking tab is only displayed if you had Geoblocking enabled and configured prior to Controller version 7.2.4820.

<Note>
  The Geoblocking tab is only displayed if you had Geoblocking enabled and configured prior to Controller version 7.2.4820.

  Aviatrix recommends using Distributed Cloud Firewall and its integration with
  ExternalGroups to monitor for threats and enable geoblocking.
</Note>

This section describes the Geoblocking feature of Aviatrix CoPilot. You access
Geoblocking in CoPilot by going to Home > Security > ThreatIQ > Geoblocking.

Geoblocking allows you to select a country to block IP traffic coming into and
coming from the country. When Geoblocking is enabled for a country, a tag-based
security policy is implemented on each gateway to deny traffic for IP addresses
associated with the country.

All gateways in your VPC/VNets will block. When you unblock a country, the tag
is removed from all gateways and the stateful firewall rules instantiated on
them for that country are removed.

<Note>
  If Geoblocking is disabled (from Setting > Configuration > License tab under
  Feature Previews) this feature is not available. When you disable Geoblocking
  you are prompted that all blocking IPs will be removed.

  * Users with admin permissions can enable the feature (prior to Controller
    7.2.4820 only; in 7.2.4820 and later, if the Geoblocking feature is disabled,
    it cannot be re-enabled).
  * When you enable Geoblocking on the License tab, you are informed that a
    tag-based security policy will be implemented on each gateway, to deny traffic
    for IP addresses associated with the country. All gateways in those VPC/VNets
    will be blocked.
</Note>

## Configuring Geoblocking

Configure Geoblocking to block IP traffic coming into and coming from a country.

<Note>
  A cloud-region IP may be blocked if that region is in the blocked country. For
  example, if the public IP for your service is registered in a specific country
  by the cloud and you block that country.
</Note>

By clicking on the country name, you can view recent IP traffic going to or
coming from that selected country in the time range you specify.

To configure Geoblocking, you must log in to CoPilot with a user account that
belongs to a group that has either `all_write` or `all_security_write`
permissions.

To configure Geoblocking, use the following steps:

1. In CoPilot, go to **Security > ThreatIQ > ThreatIQ > Geoblocking**.

   A list of the countries you can block and unblock displays. The IPs Observed
   column shows you the number of IP addresses CoPilot observed from each
   country when scanning Netflow records over the last seven days. If you click
   on a country name, you can view recent IP traffic going to or coming from
   that selected country in the time range you specify.

2. In the Status column, toggle the switch to **Blocked** for each country you
   want to block IP traffic.

3. Click **Save**.

   IP traffic coming into and coming from that country will be blocked on each
   Aviatrix gateway.

   <Note>
     Each time you toggle the switch for a country to block or unblock, you must
     click **Save** for your changes to take effect.
   </Note>

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/threatiq"}>
    Blocking Known Threat IP Traffic using ThreatIQ
  </a>