Can't get GeoIP Blocking to Work

[feerlessleadr]

Hi All - fairly new to opnsense but have been getting up to speed quickly.

I'm trying to setup geo-ip blocking on my WAN using aliases and firewall rules, but despite my best efforts IPs from countries I'm supposed to be blocking are still able to access services that I have externally exposed through caddy (hosted on a VM on proxmox behind OPNSense).

I followed the official documentation (here) to add maxmind db to opnsense, and everything updates correctly.

I then created an alias for the US (to test after I thought that the blocking wasn't working). I then created a firewall rule on my WAN (I have to use a vlan to connect to my fiber provider) and placed it at the top, with the attached settings. When I use my phone (not on wifi and not on VPN, located in the US), I'm still able to access all of my externally facing services.

Does anyone have an idea of what I'm doing wrong?

Thanks!

[AhnHEL]

Did you reset the State Table after creating your rules?

Firewall: Diagnostics: States: Reset State Table

[feerlessleadr]

Thanks for the suggestion - I tried doing that, but it still seems like my external services are visible from blocked countries.

[Seimus]

And is the GeoIP table/Alias populated? or is it empty?

Regards,
S.

[cookiemonster]

If is the top rule, shouldn't the destination be the WAN address ?