EdgeGuard — Country Groups
Named sets of countries used as @name in any geographic condition: why the @ matters, why eu27 is not @EU, and what happens to a rule when a group is deleted.
Named sets of countries you can use in any geographic condition by writing
@name— in a firewall rule, or in a site's geo policy.
Instead of pasting twenty-seven codes into every rule that means "the EU", you write @eu27 and maintain the membership in one place. When a country joins or leaves, you change one group rather than every rule that mentioned it.
Three kinds of token
Any country field in EdgeGuard accepts all three, mixed freely in the same list:
| You write | It means |
|---|---|
PT, RU, CN |
that country, by its ISO 3166-1 alpha-2 code |
@EU, @AS, @AF, @NA, @SA, @OC, @AN |
that continent, as the GeoIP lookup reports it |
@eu27, @gcc, @asean, … |
a named group, defined on this page |
RU,CN,@AF,@eu27 is one valid list. A leading ! negates the whole list: !@EU is everyone outside Europe.
The @ is not decoration
Four continent codes are also country codes. A rule written to block North America as a bare NA blocks Namibia instead, and you find out from a customer:
| Code | As a country | With the @ |
|---|---|---|
AF |
Afghanistan | @AF Africa |
AS |
American Samoa | @AS Asia |
NA |
Namibia | @NA North America |
SA |
Saudi Arabia | @SA South America |
Two bare letters are always a country. A continent always carries the @. The page lists the seven continents with that warning beside them, and the firewall rule form reads the whole condition back in plain language as you type it — see Firewall Rules.
Continents need no group
The lookup that resolves the country resolves the continent at the same time, so @EU costs nothing and can never fall out of date. A group is a list somebody maintains — which is why groups live here, and why every one of them expands on screen.
A group whose contents nobody can see is a political decision hidden in a text box.
The groups that ship
| Group | What it is |
|---|---|
eu27 |
the European Union's 27 member states |
eea |
the EU 27 plus Iceland, Liechtenstein and Norway |
schengen |
the Schengen Area |
gcc |
Gulf Cooperation Council |
asean |
Association of Southeast Asian Nations |
mercosur |
Mercosur full members |
nordics |
the Nordic countries |
western-asia |
the UN subregion |
middle-east |
not a standard — see below |
Eight of the nine have a document behind them that anyone can check. "Middle East" has no internationally agreed membership — whether Egypt, Turkey or Cyprus belong depends who you ask — so the one that ships states the definition it uses in its description, and you are expected to edit it to yours.
eu27 is not @EU
Deliberately different sets, and the difference matters when the rule is about a legal boundary:
- Norway, Switzerland and the United Kingdom are in Europe and not in the union.
- Cyprus is in the union, and the database places it in Asia.
A legal boundary is a group; a rough geographic sweep is a continent. Cloudflare solves the same problem with a separate "is in the European Union" flag; EdgeGuard does it with two names.
Adding a group
Add Group →
- Name — one word, no spaces, longer than two letters so it cannot be mistaken for a continent code. It is what you type after the
@. - Description — where the membership comes from: a treaty, a standard, or your own decision. Somebody will ask in a year, and the answer should not be "whoever made this".
- Countries — two-letter ISO codes separated by commas, spaces or new lines. Anything that is not two letters is ignored.
- Save. Agents pick it up within about 30 seconds; nothing restarts.
Built-in groups can be edited like any other. Their memberships are the shipped defaults, not the truth handed down — if your legal team defines the Middle East differently, edit it.
Deleting one
Delete on the row, with a confirmation that says what will happen.
A rule that still says
@thatnameafterwards matches nothing. It does not fall back to matching everything, which is the safe direction — but it is silent, so search your rules for the name before deleting a group.
The same is true of a name nobody ever defined: @nosuchgroup matches nothing rather than being read as a country code. A geographic rule that matches by accident is the kind that blocks a continent at three in the morning.
Verifying
1. That the group resolves. Write a firewall rule with action Log Only, countries @eu27, scope one site. The reading under the field should say "Matches visitors in eu27 (27 countries)". Watch the HITS column and the events.
2. That the engine has it. A group is pushed to the agents with the rest of the configuration. If a rule using @name never matches anything at all, check the agent's version and its last contact on Agents.
3. The difference between the two Europes. A rule with @EU and one with @eu27 should disagree about a visitor from Norway or Switzerland. That is the test that proves you picked the right one.
Country groups and continent tokens need central 2.4.21 and engine 3.0.31. An older engine reads
@EUas a country code that does not exist, and matches nothing — silently, in the safe direction.
Where a group is the wrong tool
- One country → write the code. A group of one is a code with a name.
- A rough geographic sweep → a continent, which needs no maintenance.
- A set of addresses rather than countries → IP Lists, or an ASN condition in a firewall rule.
- A different policy per country for one site → the site's own geo settings, under Tenants.