--- title: How can I geoblock with an API gateway? | daily.dev description: Geoblocking restricts API access based on the geographic location of incoming requests, using geolocation registries that map IP addresses to regions. It helps... canonical: https://daily.dev/posts/how-can-i-geoblock-with-an-api-gateway--mpjwlhlfv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How can I geoblock with an API gateway? | daily.dev og:description: Geoblocking restricts API access based on the geographic location of incoming requests, using geolocation registries that map IP addresses to regions. It helps... og:url: https://daily.dev/posts/how-can-i-geoblock-with-an-api-gateway--mpjwlhlfv og:image: https://api.daily.dev/og/posts/MpJwLhlfv.png og:image:alt: How can I geoblock with an API gateway? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How can I geoblock with an API gateway? **[ngrok Blog](https://daily.dev/sources/ngrok)** · 4 min read · 0 upvotes · 0 comments ## Summary Geoblocking restricts API access based on the geographic location of incoming requests, using geolocation registries that map IP addresses to regions. It helps with security, compliance, and performance by filtering out unwanted or risky traffic. Using ngrok's Traffic Policy engine, developers can write CEL expressions with conn.geo variables (like country_code, city, latitude, longitude, and radius) to block or route requests at both the HTTP and TCP layers. Considerations include false positives from VPNs/proxies, performance trade-offs depending on where blocking happens, and balancing compliance with user accessibility. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I block API requests from specific countries using ngrok? Use ngrok's Traffic Policy engine with Common Expression Language (CEL) expressions referencing the conn.geo.country_code variable, which uses two-letter country codes. Write a rule that matches the target country codes and returns a custom-response with status_code 403 to block those requests, applied under the on_http_connect phase. _Teams enforcing regional access rules can track API gateway techniques like this on daily.dev._ ### What geo-based variables are available for filtering traffic in ngrok's Traffic Policy? The conn.geo namespace provides variables for country_code, city, longitude, latitude, server region, and radius, the last representing the kilometers around a latitude and longitude where the conn.client_ip is likely to originate. These allow granular geo-based filtering rules beyond just country-level blocking, for both HTTP and TCP connections. _Developers designing granular access controls can follow API gateway configuration details on daily.dev._ ### What are the downsides of IP-based geoblocking for an API? IP-based geoblocking can produce false positives because not all IP addresses map reliably to a specific location, especially when users connect through VPNs or proxy services. It can also frustrate legitimate users traveling across borders or using cross-border services, so blocking rules must balance compliance needs against usability. _Engineers weighing security versus usability trade-offs can compare approaches like this on daily.dev._ ## Similar posts on daily.dev - [How to Test Geo-Dependent Web Apps Without Leaving Your Desk](https://daily.dev/posts/how-to-test-geo-dependent-web-apps-without-leaving-your-desk-nca5wwrl4) · SitePoint · 0 upvotes · 1 comments - [Imgur Geo-Blocked the UK, So I Geo-Unblocked My Entire Network](https://daily.dev/posts/imgur-geo-blocked-the-uk-so-i-geo-unblocked-my-entire-network-dbogmjkdu) · Hacker News · 0 upvotes · 0 comments - [One IP address, many users: detecting CGNAT to reduce collateral effects](https://daily.dev/posts/one-ip-address-many-users-detecting-cgnat-to-reduce-collateral-effects-feiedp7f2) · Cloudflare · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#networking](https://daily.dev/tags/networking), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/how-can-i-geoblock-with-an-api-gateway--mpjwlhlfv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How can I geoblock with an API gateway?","url":"https://daily.dev/posts/how-can-i-geoblock-with-an-api-gateway--mpjwlhlfv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-can-i-geoblock-with-an-api-gateway--mpjwlhlfv"},"datePublished":"2026-08-23T07:20:32.562Z","dateModified":"2026-08-23T07:23:22.954Z","description":"Geoblocking restricts API access based on the geographic location of incoming requests, using geolocation registries that map IP addresses to regions. It helps...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a83303f2cc1997690f88d0fb3e22e97?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a83303f2cc1997690f88d0fb3e22e97?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-can-i-geoblock-with-an-api-gateway--mpjwlhlfv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,networking,api-gateway","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"How can I geoblock with an API gateway?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-can-i-geoblock-with-an-api-gateway--mpjwlhlfv#faq","mainEntity":[{"@type":"Question","name":"How do I block API requests from specific countries using ngrok?","acceptedAnswer":{"@type":"Answer","text":"Use ngrok's Traffic Policy engine with Common Expression Language (CEL) expressions referencing the conn.geo.country_code variable, which uses two-letter country codes. Write a rule that matches the target country codes and returns a custom-response with status_code 403 to block those requests, applied under the on_http_connect phase. Teams enforcing regional access rules can track API gateway techniques like this on daily.dev."}},{"@type":"Question","name":"What geo-based variables are available for filtering traffic in ngrok's Traffic Policy?","acceptedAnswer":{"@type":"Answer","text":"The conn.geo namespace provides variables for country_code, city, longitude, latitude, server region, and radius, the last representing the kilometers around a latitude and longitude where the conn.client_ip is likely to originate. These allow granular geo-based filtering rules beyond just country-level blocking, for both HTTP and TCP connections. Developers designing granular access controls can follow API gateway configuration details on daily.dev."}},{"@type":"Question","name":"What are the downsides of IP-based geoblocking for an API?","acceptedAnswer":{"@type":"Answer","text":"IP-based geoblocking can produce false positives because not all IP addresses map reliably to a specific location, especially when users connect through VPNs or proxy services. It can also frustrate legitimate users traveling across borders or using cross-border services, so blocking rules must balance compliance needs against usability. Engineers weighing security versus usability trade-offs can compare approaches like this on daily.dev."}}]} ```