Document status	35 - Reviewed

Geo-Blocking Policy

This document describes the geo-blocking policy implemented on Azure Front Door to restrict access to EnergyConnect based on geographic location.

Overview

EnergyConnect implements geo-blocking at the Azure Front Door level using a Web Application Firewall (WAF) policy. This security measure ensures that only users from approved countries can access the platform, providing an additional layer of protection against unauthorized access and potential attacks from restricted regions.

Architecture

WAF Policy Configuration

Policy Details

Setting	Value
Policy Mode	Prevention
SKU	Standard_AzureFrontDoor
Request Body Check	Enabled

Custom Rules

Each WAF policy contains two geo-blocking rules to ensure comprehensive coverage:

Rule 1: geoblockingSocket (Priority 100)

Property	Value
Match Variable	SocketAddr
Operator	GeoMatch
Condition	Is NOT in allowed countries
Action	Block

This rule checks the client's socket address (direct IP connection) for geographic location.

Rule 2: geoblockingRemote (Priority 200)

Property	Value
Match Variable	RemoteAddr
Operator	GeoMatch
Condition	Is NOT in allowed countries
Action	Block

This rule provides additional coverage by checking the remote address, which may differ from the socket address when proxies are involved.

Why Two Rules?

• SocketAddr: Represents the client's actual IP address as seen by Azure Front Door
• RemoteAddr: May contain the original client IP when requests pass through proxies

Using both ensures geo-blocking works correctly regardless of whether traffic passes through intermediate proxies.

Security Policy Association

The WAF policy is attached to Front Door endpoints and custom domains via a Security Policy:

Component	Description
Associated WAF	Customer-specific WAF policy
Protected Resources	All Front Door endpoints and custom domains

Important Note

Azure Front Door allows only one security policy per WAF-to-profile association. When adding new endpoints or custom domains, they must be added to the existing security policy rather than creating new ones.

Adding New Domains to Protection

When a new environment or service is deployed, the new endpoint and custom domain must be manually added to the security policy:

1. Navigate to Azure Front Door resource in Azure Portal
2. Go to Security policies → Select the security policy
3. Click Edit
4. Under Domains, select the new domains to protect
5. Click Save
6. Wait up to 45 minutes for global propagation

Blocked Request Response

When a request is blocked by the geo-blocking policy:

Response Element	Value
HTTP Status Code	403 Forbidden
Response Body	"The request is blocked"
Browser Tab Title	"Service unavailable"
x-azure-ref Header	Contains tracking reference

Example Blocked Response

HTTP/1.1 403 Forbidden
Content-Type: text/html
x-azure-ref: 20260122T153028Z-17894444b94xbpjhhC1HKGkdrs000000046g00000000he5w