Help with rule to block incoming connections not on GeoIP alias

[Taomyn]

What rule(s) do I need that will block/redirect all incoming connections that are not in a GeoIP alias?


I have a GeoIP alias of the countries I want incoming connections to be allowed for, but everything else should be blocked. Better still, this traffic should ideally be redirected to a honeypot device in a DMZ.


Some services I do want to allow from anywhere e.g. Torrent traffic already NAT'ed, and outbound connections should not be restricted i.e. I should still be able to access websites in countries not on the list.


Is all this possible? I've been trying for months and either what I configure doesn't block anything or it blocks everything including the services I want to allow the traffic from.