# Location Blocking with an exception **URL:** \ **Category:** Security\ **Created:** [29 May 2023 18:24 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821 "2023-05-29T18:24:15Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![gamgee](https://community.ipfire.org/user_avatar/community.ipfire.org/gamgee/32/14535_2.png) [@gamgee](https://community.ipfire.org/u/gamgee)\ **Post date:** [29 May 2023 18:24 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/1 "2023-05-29T18:24:15Z")
I have Location Blocking enabled for many countries. I’d like to allow a single port (24554) to be allowed into my network from anywhere, even if it originates from a blocked country. How can I do this? Thank you. ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [29 May 2023 18:49 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/2 "2023-05-29T18:49:47Z")
Welcome to the community. Take this with a grain of salt. I think you should use the [Web User Interface](https://wiki.ipfire.org/configuration/firewall/rules) to create an “allow” rule. Select source: RED; destination: GREEN or any, Protocol: TCP (or UDP), destination port: 24554, select “ACCEPT”. Save and restart the firewall. These details will seem gibberish if you never dealt with iptables, which is Linux firewall. I report these details in case you want to have a starting point and maybe someone else might give some other info. We can talk about it more if you need some clarification. The Web User Interface should create a rule in the INPUT chain of the FILTER table that should jump to the CUSTOMINPUT chain before it goes to LOCATIONBLOCK chain and this way it should allow the traffic to enter. I think this should work, but I am far from an expert. If you can, let us know if you succeed. If you go in Web User Interface, /FIREWALL/IPTABLES/ the first table shown there is the FILTER table. The drop down menu will show all the chains of that table. In CUSTOMINPUT you should see the rule I suggested (after you create it) and the log of how many packets have transversed it. You can also see the LOCATIONBLOCK chain as well. Give it a try, after a while it starts to make sense 🙂 ---
**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\ **Post date:** [29 May 2023 19:59 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/3 "2023-05-29T19:59:48Z")
Read this. Location block is first So creating location groups is the easiest way. And not use location block > [@Location Block filter strictly before FW input](https://community.ipfire.org/t/location-block-filter-strictly-before-fw-input/3870): > > I just want to discuss if it’s necessary to have the Location Block filter right in front of the firewall input fixed. I think this limits its usage a little bit. E.g. if an IPFire instance is installed right in front of a server and the server is handling mail, it’s important, that the server can get connections from all over the world. So Location Block must be turned off. If another service on this server needs the location block, locations groups need to be created to get a similar functio… ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [29 May 2023 20:26 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/4 "2023-05-29T20:26:32Z")
Thank you. I have forgotten that. ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [29 May 2023 20:52 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/5 "2023-05-29T20:52:25Z")
> [@hvacguy](#): > > Location block is first Now I get it. If I check the order of chains in the filter table, LOCATIONBLOCK comes after CUSTOMINPUT, which I assumed it was the chain where the rule OP wanted to create would end up (wrong!). Well, it turns out that such a rule ends up in INPUTFW and FORWARDFW which are way below LOCATIONBLOCK. ---
**Author:** ![gamgee](https://community.ipfire.org/user_avatar/community.ipfire.org/gamgee/32/14535_2.png) [@gamgee](https://community.ipfire.org/u/gamgee)\ **Post date:** [30 May 2023 14:18 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/6 "2023-05-30T14:18:48Z")
Shaun, thank you for this info. I’m reading up on it and will give it a try. Really appreciate the help! ---
**Author:** ![gamgee](https://community.ipfire.org/user_avatar/community.ipfire.org/gamgee/32/14535_2.png) [@gamgee](https://community.ipfire.org/u/gamgee)\ **Post date:** [30 May 2023 14:20 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/7 "2023-05-30T14:20:09Z")
cfusco, thank you for your reply. As I’m reading things, it appears the Location Block will still “override” an entry of this type. Going to give the Location Groups thing a try. Appreciate the help! ---
**Author:** ![gamgee](https://community.ipfire.org/user_avatar/community.ipfire.org/gamgee/32/14535_2.png) [@gamgee](https://community.ipfire.org/u/gamgee)\ **Post date:** [31 May 2023 12:53 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/8 "2023-05-31T12:53:35Z")
Shaun, just as a sanity check to make sure I’m understanding this… does the below sound correct to you? Seems like it will work the way I want it to, just checking… 1. Turn off Location Block 2. Create a Location Group of countries I wish to block, with a source of Any and a destination of Green. 3. Create a rule to pass my desired port (24554) from source of Any to my specific green host/port. 4. Make sure the above rule for port 24554 is listed FIRST in my rules list. 5. Make another rule to DROP all from source Location Group (step 2) to destination Green, and have this as the second listed rule. 6. Add any other rules for specific ports/port forwarding as needed, below the above two rules. My understanding is that the first rule will allow anyone/anywhere to access my Green host on port 24554, and the second rule will stop all other access from designated (Location Group) countries. Then the remaining rules will allow access to other ports, but only from unblocked countries. Seem right? Thank you. ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [31 May 2023 12:55 UTC](https://community.ipfire.org/t/location-blocking-with-an-exception/9821/9 "2023-05-31T12:55:12Z")
> [@gamgee](#): > > Seem right? not @hvacguy however to me what you posted looks exactly right.