How to solve the issue that GEO-IP blocks internal LAN IP that belongs to a certain Geo Region IP?

Zyxel_Emily

The administrator wants to block web GUI access from Venezuela so the following security policy is created. However, GEO-IP blocks internal LAN IPs because the LAN subnet has the same IP range of a certain Geo Region IP. How to solve this issue if it is impossible to change the LAN IP address?

Suppose you'd like to block web GUI access from Venezuela. Create an address object by selecting "Venezuela".

Suppose the IP address of lan1 belongs to Venezuela.

In the security policy rule, you can assign a specific zone in “From” and “To” to limit the source/destination IP coming from/to a certain “zone”.Create a security policy rule to block traffic from Venezuela to ZyWALL.From: WAN, To: ZyWALL, Source: All Venezuela, action: deny

From one PC 190.168.1.2 in LAN1, it is still able to access the web GUI 190.168.1.1 successfully because the traffic if from zone “LAN1” but not “WAN”. Hence, it doesn’t hit the block_test rule.