Cloudflare Docs
WAF
Visit WAF on GitHub
Set theme to dark (⇧+D)

Allow traffic from specific countries only

This example blocks requests based on country code using the ip.geoip.country field, only allowing requests from two countries: United States and Mexico.

Expression Action
(not ip.geoip.country in {"US" "MX"}) Block