How do I allow requests with unmapped geolocation in AWS WAF?

Short description

Understand why some requests show unmapped geolocation

AWS WAF determines the geolocation of web requests using MaxMind GeoIP databases. By default, it uses the web request's origin IP address for this lookup. If the country or region code is not available for the specified IP address, AWS WAF assigns the labels awswaf:clientip:geo:country:XX and awswaf:clientip:geo:region:XX-XX. The country field for these requests appears as '-' in WAF sampled requests and logs. Some scenarios where this occurs include:

• The IP address is private and not routable on the internet.
• A newly allocated public IP has not yet been added to the MaxMind GeoIP database.

Note: AWS WAF updates its GeoIP data on a regular basis. However, there might be a delay between when an IP is added to the MaxMind GeoIP database and when that update takes effect in AWS WAF. During this interim period, use an IP set match rule statement to allow or block the affected IP addresses.

Understand how unmapped geolocation interacts with geo-block rules

If you have a rule that blocks traffic not originating from specific countries (using a NOT geo match statement with a Block action), requests with unmapped geolocation are also blocked. The unmapped IP does not match any country code in your allow list, so the NOT statement evaluates to true and the block action applies.

For example, the following rule blocks requests not from US or CA. This includes requests with unmapped geolocation, because they do not match any of the listed country codes:

{
    "Name": "geo-block",
    "Priority": 6,
    "Statement": {
        "NotStatement": {
            "Statement": {
                "GeoMatchStatement": {
                    "CountryCodes": [
                        "US",
                        "CA"
                    ]
                }
            }
        }
    },
    "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "geo-block"
    },
    "Action": {
        "Block": {}
    }
}

Resolution

Option 1: Add unmapped IPs to an IP set (small number of IPs)

Use this approach when only a small number of legitimate IP addresses are blocked because of unmapped geolocation.

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose Protection packs (web ACLs).
3. Select the protection pack (web ACL) that you want to edit. This opens a side pane with details you can edit.
4. Choose Manage rules and then, choose Add rule.
5. On the Add new rule page, choose Custom rule and then, choose Next.
6. On the Choose rule type page, choose IP-based rule and then, choose Next.
7. For Action, choose Allow.
8. For Rule name, enter a name for the rule.
9. For Statement, you have two options:
   Option 1: To use an existing IP set: 
   Toggle Use existing IP set.
   From the IP address list dropdown, choose the IP set that contains the IP addresses whose geolocation is unmapped and that you want to allow. For information about creating and managing an IP set, see Creating and managing an IP set in AWS WAF.
   Option 2: To enter IP addresses directly: 
   Do not toggle Use existing IP set.
   Choose the IP address version (IPv4 or IPv6).
   Enter the IP addresses in CIDR format (for example, 203.0.113.0/32 for IPv4 or 2001:db8::1/128 for IPv6), separated by new lines.
10. Under Rule configuration, for Source IP address for origin, choose Source IP address.
11. (Optional) Expand the Custom request – optional section and then, choose Add new custom header. Then enter a value for the Key and Value fields.
12. Choose Add rule.
13. To change the priority of the rule, choose Edit rule order.
14. Drag the rule up and place it above the geo-block rule. This verifies that the IP-based rule is evaluated first.
15. Choose Save rule order.
16. Submit a data correction request to MaxMind at Correct a GeoIP location so the IPs are correctly mapped in future database updates. Keep the IP-based rule in place until the correction is reflected in AWS WAF.

Option 2: Use label matching to allow unmapped geolocation (large number of IPs)

When you have a large number of legitimate IPs with unmapped geolocation, managing them individually in an IP set or submitting correction requests to MaxMind for each one adds significant operational overhead. Instead, use label matching to allow traffic that carries the awswaf:clientip:geo:country:XX label.

Step 1: Set your existing geo-block rule to Count

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose Protection packs (Web ACLs).
3. Select the protection pack (web ACL) that you want to edit. This opens a side pane with details you can edit.
4. Choose Manage rules and then choose your existing geo-block rule to edit.
5. Change the Action from Block to Count. This verifies that the rule adds geolocation labels to requests without blocking them.
6. Choose Save Rule.

Step 2: Create a custom rule to block non-allowed countries while allowing unmapped geolocation

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose Protection packs (Web ACLs).
3. Select the protection pack (web ACL) that you want to edit. This opens a side pane with details you can edit.
4. Choose Manage rules and then, choose Add rule.
5. On the Add new rule page, choose Custom rule and then, choose Next.
6. On the Choose rule type page, choose Custom rule and then, choose Next.
7. For Action, choose Block.
8. For Rule name, enter a name for the rule.
9. For If a request, choose matches all the statement (AND).
10. For Statement 1:
    For Inspect, choose Originates from a country in.
    From Country dropdown, choose United States – US and Canada – CA.
    Under Rule configuration, select Negate statement results checkbox.
    For Source IP address for origin, choose Source IP address.
11. For Statement 2:
    For Inspect, choose Has a label.
    For Match scope, choose Label.
    For Match key, enter awswaf:clientip:geo:country:XX.
    Under Rule configuration, select Negate statement results checkbox.
12. (Optional) Expand the Custom response – optional section and then, select Enable. Then configure the response code, headers, and body.
13. Choose Add rule.
14. To change the priority of the rule, choose Edit rule order.
15. Drag the rule down and place it below the geo-block rule. This verifies that the geolocation labels are applied before this rule evaluates them.
16. Choose Save rule order.

With this configuration, a request is blocked only when it does not originate from your allowed countries (US or CA) AND does not carry the unmapped geolocation label (awswaf:clientip:geo:country:XX). This means requests with unmapped geolocation are not blocked by this rule because they fail to satisfy both conditions simultaneously.

The tradeoff is that while this approach prevents legitimate IPs with no geolocation mapping from being inadvertently blocked, traffic from countries you intend to restrict could also avoid this block if those IPs happen to be unmapped. Evaluate whether this acceptable risk outweighs the operational overhead of managing individual IP exceptions before implementing this option.

Note: If your requests pass through proxies, CDNs, or load balancers before reaching AWS WAF, then the source IP evaluated is the proxy's address rather than the original client's. To handle this, configure your geo match rule to use a forwarded IP header (such as X-Forwarded-For) to evaluate the original client IP instead. When forwarded IP configuration is activated, the unmapped geolocation label changes to awswaf:forwardedip:geo:country:XX and awswaf:forwardedip:geo:region:XX-XX. Update your label match statements accordingly.