Sophos UTM country blocking - blocking geo allowed IP

Question

Greetings, 
 
 My utm firewall is for some reason blocking a US based cloudfare IP for Discord. This started a couple days ago I think. 
 I of course don't have the US blocked in country blocking, but the country blocking rule is blocking it.. Here is some data for this. I think this may be some sort of FP perhaps?? 
 From the Shell: 
 geoiplookup 162.159.135.232 GeoIP Country Edition: US, United States 
 
 From the network logs: 
 2023:04:04-10:41:23 bouncerasg ulogd[13546]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="lag0" outitf="eth5" srcmac="" dstmac="" srcip="<mypc>" dstip="162.159.135.232" proto="17" length="1378" tos="0x00" prec="0x00" ttl="127" srcport="63248" dstport="443" 
 
 From the UI:

I know I can just exclude the IP, but why is the firewall doing this?!?! 
 
 Thanks, Chris

HayMak3r · Answer

I just wanted to report that I opened a support ticket up, and the support agent was fantastic. But, in the end, when we turned country blocking back on, the issue was no longer present. today's pattern version must have included an additional whitelist for the cloudfare ips I was having an issue with. I will continue monitoring, but for now, all is well. I'll reply back here if the issue comes back.

Sophos UTM country blocking - blocking geo allowed IP

Top Replies