GeoIP blocking with IP supression

[DanAvni]

Hi,

I have set up pfBlockerNG-devel with GeoIP blocking for some countries. Within one of those countries I need to enable access to/from specific IP address subnets, but I want the county to still stay blocked (except for these subnets). How can this be done?

[johnpoz]

Put a rule that allows whatever subnets you want, above the rule that blocks them.

[DanAvni]

@johnpoz , Do you mean in the floating rules list?
If that rules matches then traffic passes the floating rules but will it then be evaluated in the regular WAN rules? (I mean: do I put a specific floating rule just like in the WAN saying "traffic from allowed IP to LAN on port 443 is ok" or do I put a rule "traffic from allowed IP is ok" and then the WAN rules will filter based on already existing rules?

[johnpoz]

Doesn't have to be on floating, but that would be one way to put it before a rule on interface. It needs to be above the rule your using for pfblocker.