[Mod-security-rules] GeoLocation Rule

[Rishi N. <ia...@pw...>]

Hey,

I have configured the following rules and would like to know if there is
any issue with them as I am not getting the intended results,

SecGeoLookupDb /etc/modsecurity/GeoLiteCity.dat
> SecRule REMOTE_ADDR "@geoLookup" "phase:1,id:13102,t:none,pass,log"


I have the GeoLiteCity.dat file in the working directory. And here is the
log snippet,

Executing operator "geoLookup" with param "" against REMOTE_ADDR.
> Operator completed in 114 usec.
> Warning. Geo lookup for "119.82.124.222" succeeded. [file
> "/etc/modsecurity/modsecurity.conf"] [line "14"] [id "13102"]
> Rule returned 1.


Kindly excuse me if I missed something.

Regards,
Rishi Narang