FW19 country blocking

messageid="16001" log_type="Content Filtering" log_component="HTTP" log_subtype="Allowed" fw_rule_id="5" fw_rule_name="#Default_Network_Policy" fw_rule_section="Local rule" user="" user_group="" web_policy_id="12" web_policy="Default Policy" category="Portal Sites" category_type="Unproductive" url="https://www.rambler.ru" content_type="" override_token="" src_ip="192.168.1.104" dst_ip="81.19.82.98" protocol="TCP" src_port="62370" dst_port="443" bytes_sent="4447" bytes_received="82440" domain="www.rambler.ru" exception="" activity_name="" reason="" user_agent="" status_code="0" transaction_id="" referer="" download_file_name="" download_file_type="" upload_file_name="" upload_file_type="" con_id="3316794944" app_name="" app_is_cloud="0" override_name="" override_authorizer="" used_quota="0"

messageid="16001" log_type="Content Filtering" log_component="HTTP" log_subtype="Allowed" fw_rule_id="5" fw_rule_name="#Default_Network_Policy" fw_rule_section="Local rule" user="" user_group="" web_policy_id="12" web_policy="Default Policy" category="Portal Sites" category_type="Unproductive" url="https://www.rambler.ru" content_type="" override_token="" src_ip="192.168.1.104" dst_ip="81.19.82.98" protocol="TCP" src_port="62370" dst_port="443" bytes_sent="4447" bytes_received="82440" domain="www.rambler.ru" exception="" activity_name="" reason="" user_agent="" status_code="0" transaction_id="" referer="" download_file_name="" download_file_type="" upload_file_name="" upload_file_type="" con_id="3316794944" app_name="" app_is_cloud="0" override_name="" override_authorizer="" used_quota="0"

Is the country blocking rule you created on the top of the fw rules list ?
Which source countries have you tried to block ?
Can you provide us a screenshot of the FW rules and the FW log viewer if the country blocking rule is getting detected ?

country blocking rule is the top of the fw rules!

sorry, "log viewer if the country blocking rule"

where can I find that? ...

logging is turned on

Hello weissnix, 

So the action you kept is "reject," right? I do not understand the source zone and destination zone as well as the destination network? Can you translate ?

You are blocking something coming from those countries to your Firewall.

Your Log entry is from the Webproxy Log, means some client in your network is actively opening a website. For this you need to block those Countries in the destination. You need a new firewall rule to block everything from your LAN to those countries as well.