--- title: 'lfd:country' url: 'https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-country' markdown: 'https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-country.md' date: '2026-10-07' description: 'Block or allow specific countries through the firewall. All country code options use ISO 3166-1 alpha-2 country codes. See: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2 juggernaut --task=lfd:country Option Value Default Description --CC_SRC <1|2> 1 The source for where CSF dow…' taxonomy: category: - docs tag: - country --- [](#) [ Basics ](https://docs.danami.com/juggernaut/) [ Command Line Interface ](https://docs.danami.com/juggernaut/command-line-interface) Lfd lfd:country # lfd:country Block or allow specific countries through the firewall. All country code options use ISO 3166-1 alpha-2 country codes. See: [https://en.wikipedia.org/wiki/ISO\_3166-1\_alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) ``` juggernaut --task=lfd:country ``` | Option | Value | Default | Description | |---|---|---|---| | `--CC_SRC` | <1\|2> | 1 | The source for where CSF downloads its country databases. Use 1 for MaxMind or 2 for DB-IP. | | `--MM_LICENSE_KEY` | | | MaxMind requires you to create a free account on their site and to generate a license key to use their Geolite2 databases. See [here](https://docs.danami.com/juggernaut/basics/getting-started#get-a-maxmind-license-key) for more information. | | `--CC_DENY` | | | Deny whole country or ASN CIDR ranges. The CIDR blocks are generated from the Maxmind GeoLite2 Country database and entirely relies on that service being available. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_DENY_add` | | | Add a single entry to CC\_DENY. | | `--CC_DENY_del` | | | Remove a single entry from CC\_DENY. | | `--CC_ALLOW` | | | Allow whole country or ASN CIDR ranges. Warning: this option allows access through all ports in the firewall. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_ALLOW_add` | | | Add a single entry to CC\_ALLOW. | | `--CC_ALLOW_del` | | | Remove a single entry from CC\_ALLOW. | | `--CC_ALLOW_FILTER` | | | Only allow access from the following countries or ASN but still filter based on the port and packets rules. All other connections are dropped. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_ALLOW_FILTER_add` | | | Add a single entry to CC\_ALLOW\_FILTER. | | `--CC_ALLOW_FILTER_del` | | | Remove a single entry from CC\_ALLOW\_FILTER. | | `--CC_IGNORE` | | | Prevent the login failure daemon from blocking IP address hits for the following countries or ASNs. CC\_LOOKUPS must be enabled to use this option. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_MESSENGER_ALLOW` | | | Only a blocked IP that resolves to one of these country codes will be redirected to the MESSENGER service. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_MESSENGER_ALLOW_add` | | | Add a single entry to CC\_MESSENGER\_ALLOW. | | `--CC_MESSENGER_ALLOW_del` | | | Remove a single entry from CC\_MESSENGER\_ALLOW. | | `--CC_MESSENGER_DENY` | | | A blocked IP that resolves to one of those Country Codes will NOT be redirected to the MESSENGER service. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_MESSENGER_DENY_add` | | | Add a single entry to CC\_MESSENGER\_DENY. | | `--CC_MESSENGER_DENY_del` | | | Remove a single entry from CC\_MESSENGER\_DENY. | | `--CC_DROP_CIDR` | | | Ignore CIDR blocks smaller than this value when implementing CC\_DENY/CC\_ALLOW/CC\_ALLOW\_FILTER. This can help reduce the number of CC entries and may improve iptables throughput. This will deny/allow fewer IP addresses depending on how small you configure the option. Set to None to block all CC IP addresses. | | `--CC_LOOKUPS` | | 1 | Display Country Code and Country for reported IP addresses. | | `--CC6_LOOKUPS` | <1\|0> | 1 | Display Country Code and Country for reported IPv6 addresses using the MaxMind Country IPv6 Database. This option must also be enabled to allow IPv6 support to CC\_\*, MESSENGER and PORTFLOOD. | | `--CC_INTERVAL` | | 14 | How often the login failure daemon will retrieve the Maxmind GeoLite Country database for CC\_ALLOW, CC\_ALLOW\_FILTER, CC\_DENY, CC\_IGNORE and CC\_LOOKUPS (in days). | | `--CC_ALLOW_PORTS` | | | Allow access from the following countries to specific ports listed in CC\_ALLOW\_PORTS\_TCP and CC\_ALLOW\_PORTS\_UDP. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_ALLOW_PORTS_add` | | | Add a single entry to CC\_ALLOW\_PORTS. | | `--CC_ALLOW_PORTS_del` | | | Remove a single entry from CC\_ALLOW\_PORTS. | | `--CC_ALLOW_PORTS_TCP` | | | Allow access to the following TCP ports from the CC\_ALLOW\_PORTS countries. All listed ports should be removed from TCP\_IN to block access from elsewhere. | | `--CC_ALLOW_PORTS_TCP_add` | | | Add a single entry to CC\_ALLOW\_PORTS\_TCP. | | `--CC_ALLOW_PORTS_TCP_del` | | | Remove a single entry from CC\_ALLOW\_PORTS\_TCP. | | `--CC_ALLOW_PORTS_UDP` | | | Allow access to the following UDP ports from the CC\_ALLOW\_PORTS countries. All listed ports should be removed from UDP\_IN to block access from elsewhere. | | `--CC_ALLOW_PORTS_UDP_add` | | | Add a single entry to CC\_ALLOW\_PORTS\_UDP. | | `--CC_ALLOW_PORTS_UDP_del` | | | Remove a single entry from CC\_ALLOW\_PORTS\_UDP. | | `--CC_DENY_PORTS` | | | Deny access from the following countries to specific ports listed in CC\_DENY\_PORTS\_TCP and CC\_DENY\_PORTS\_UDP. (ISO 3166-1 alpha-2 country codes, comma separated) | | `--CC_DENY_PORTS_add` | | | Add a single entry to CC\_DENY\_PORTS. | | `--CC_DENY_PORTS_del` | | | Remove a single entry from CC\_DENY\_PORTS. | | `--CC_DENY_PORTS_TCP` | | | Deny access to the following TCP ports from the CC\_DENY\_PORTS countries. All listed ports should NOT be removed from TCP\_IN. | | `--CC_DENY_PORTS_TCP_add` | | | Add a single entry to CC\_DENY\_PORTS\_TCP. | | `--CC_DENY_PORTS_TCP_del` | | | Remove a single entry from CC\_DENY\_PORTS\_TCP. | | `--CC_DENY_PORTS_UDP` | | | Deny access to the following UDP ports from the CC\_DENY\_PORTS countries. All listed ports should NOT be removed from UDP\_IN. | | `--CC_DENY_PORTS_UDP_add` | | | Add a single entry to CC\_DENY\_PORTS\_UDP. | | `--CC_DENY_PORTS_UDP_del` | | | Remove a single entry from CC\_DENY\_PORTS\_UDP. | | `--default` | | | Reset all settings to their default values. | | `--default_option` |