Not all global traffic is relevant to your service.
Automatic scans and attempts often come from areas where your activity has no users.
Allow only the traffic you actually need.
Block entire countries with local GeoIP database, apply different policies for each domain and evaluate the reputation of each source IP with a score 0-100. Less attack surface, without risk of blocking good customers.
Local GeoIPFail-openReputation 0-100
Apply geographic and reputation rules locally.
Identify the IP address's country, evaluate lists and its risk score and apply the domain policy.
Less noise and a smaller attack surface.
Allow traffic from the markets you serve and keep explicit exceptions for trusted customers and systems.
Attack surface
Why reduce the geographic attack surface.
If your site only serves Italy or Europe, traffic from outside those markets is almost certainly noise, scan or attack. Filtering geography is the easiest way to get rid of large volumes of automated traffic.
01
Less hostile traffic
Traffic from countries where you have no customers are stopped before even touching the application: scanners, brute-force attempts and floods disappear from the logs.
02
Rules tailored to each site
An Italian shop allows only Italy, a European portal allows Italy, Germany, France and Spain, a technical API logs traffic from higher-risk countries without blocking. Each domain has its own policy.
03
Decisions made locally, in milliseconds
The IP address is resolved to an ISO country code on the server itself, using a local MaxMind database: no external queries, no added latency, no data leaving your infrastructure.
Geo-blocking · Local GeoIP
Your server determines the country, not a third-party cloud.
Sentinel uses the database MaxMind GeoLite2-Country (.mmdb) locally: The source IP is resolved in ISO country code directly in the agent code, without querying external services.
- Allowlist = default-deny: If you set up a list of allowed countries, only those will pass; everything else is blocked.
- Blocklist: If there is no allowlist, traffic from all countries passes except those on the blocklist.
- Mode block (answer 403) or log, so rules can be introduced in observation mode first the impact.
Policy per domain
Different countries for different sites, without false blocks.
Each request is evaluated with the right policy following a precise order: exact host → wildcard → global Thus each domain has its own geographical rules, independent of others.
- Thelocal allowlist takes precedence even on the central blocklist: a country that you admit on your domain is never accidentally blocked by a global rule.
- Blocks can be global or per-server, synchronized via gRPC mTLS; Allowlists are fully synchronised.
- Introduce every policy in log, measure the real impact, then move on to block When you're sure.
IP blocklists and allowlists
IP lists synchronised across the fleet.
In addition to geography, manage IP lists at the single address level. the allowlist has priority: a trusted IP always passes, regardless of geo, blocklist or reputation. Blocks have a TTL and are applied directly to the local firewall of each server, then synchronized by the dashboard.
01
Priority allowlist
Trusted office, monitoring and partner IP addresses are never blocked, regardless of other active rules.
02
Blocklist with TTL
The blocked IPs automatically expire after the set time: no lists that grow indefinitely and block addresses that are now clean.
03
On the local firewall
Decisions end up on the server's firewall: hostile traffic is cut upstream, before consuming application resources.
Reputation & scoring
A score from 0 to 100 for each source IP.
Sentinel calculates a reputation score where 0 is safe and 100 is malicious, by combining weighted sources. configurable threshold (default 70), IP is blocked. Gate is opt-in and supports the shadow mode to observe without blocking.
- DNSBL (40%): Spamhaus ZEN, Barracuda, SpamCop, Blocklist.de, UCEPROTECT, CBL, DroneBL.
- Local event history (30%) attacks already seen from that IP on your servers.
- Geo-risk (15%) and proxy, Tor, VPN and data centre networks (15%), plus a threat-feed bonus.
Synchronization
Sync from the dashboard in real time.
Geo rules, IP lists and reputation configuration start from the dashboard and arrive at every agent through the central server, over an encrypted, mutually authenticated channel.
01
Dashboard
Define allowlists and blocklists by country, per-domain policy, IP lists and reputation threshold. All from one console.
02
Server · gRPC mTLS
The central server distributes global or per-server blocks and retains the event history; allowlists travel in full sync.
03
Agent
The agent applies local rules on the firewall and reverse proxy: decisions in milliseconds, no data to third parties.
Operational security
Fail-open: If something is missing, traffic remains available.
Geo-blocking is designed to never turn into a service interruption: if the GeoIP database is absent or an IP address cannot be resolved to a country, the request pass instead of being blocked. Better to let in some extra requests than to block real customers for a missing file.
DB absent → passesIP unsolvable → passPriority allowlist
Frequently asked questions
Geo-blocking & reputation, in short.
Does geo-blocking send data to external services?
No. The country of each IP is solved locally with the MaxMind GeoLite2 Country database .mmdb on the server itself: no external queries, no IP address leaves your infrastructure.
What happens if the geo database isn't here?
Fail-open: if the .mmdb is absent or IP is not solved in a country code, the request passeseses. Geo-blocking never causes a total block by mistake.
How does the allowlist behave with respect to the blocklist?
A non-empty allowlist activates the default-deny: only allowed countries pass. Without allowlist, only countries on the blocklist are blocked. The local allowlist also takes precedence over the central blocklist.
Can I have different rules for each site?
Yes. The policy applies by-domain with exact host order → wildcard → global, so each domain has its own countries allowed or prohibited and its own block or log mode.
How does reputation 0-100 work?
It is a score where 0 is safe and 100 malicious, calculated by weighing DNSBL (40%), local event history (30%), geo-risk (15%), proxy/Tor/VPN/datacenter (15%) and a threat-feed bonus. Beyond the threshold (default 70) the IP is blocked.
Can I try reputation without blocking?
Yes. The gate is opt-in and supports shadow mode: you can watch the scores and what will be blocked before you activate the real block, and adjust the threshold with real data.
You just want to block what you need, without false positives?
We show you geo-blocking and reputation live on your infrastructure and tune them for your domains.