How to solve the issue that GEO-IP blocks internal LAN IP that belongs to a certain Geo Region IP?

Zyxel_Emily Posts: 1,327  Zyxel Employee
First Anniversary 10 Comments Friend Collector First Answer
edited June 2023 in Security Service

The administrator wants to block web GUI access from Venezuela so the following security policy is created. However, GEO-IP blocks internal LAN IPs because the LAN subnet has the same IP range of a certain Geo Region IP. How to solve this issue if it is impossible to change the LAN IP address?

Suppose you'd like to block web GUI access from Venezuela. Create an address object by selecting "Venezuela".

Suppose the IP address of lan1 belongs to Venezuela.

In the security policy rule, you can assign a specific zone in “From” and “To” to limit the source/destination IP coming from/to a certain “zone”.Create a security policy rule to block traffic from Venezuela to ZyWALL.From: WAN, To: ZyWALL, Source: All Venezuela, action: deny

From one PC in LAN1, it is still able to access the web GUI successfully because the traffic if from zone “LAN1” but not “WAN”. Hence, it doesn’t hit the block_test rule.

Share yours now!