Question Modsecurity + GeoIP rule not working

[surfgatinho]

I'm trying to get the following rule to work but it seems to do nothing:

# Test IP address and block by country code
SecGeoLookupDb /usr/share/GeoIP/GeoIP.dat
SecRule REMOTE_ADDR "@geoLookup" "chain,id:20,drop,msg:'Block China IP address'"
SecRule GEO:COUNTRY_CODE "@streq CN HK"​

I have had the GeoIP database installed for a while and used it successfully for other purposes, so this isn't the problem.

As it stands the above rule does nothing - no error, and no blocking.
Given the huge amount of China based traffic I've been receiving the logs should be absolutely full...

The version of Modsecurity I'm running is 2.9.2-ubuntu18.04.19091318

Any ideas?

 

[surfgatinho]

OK. I setup a modsecurity debug log and this is what I am getting for my geo lookups:

No geo data for "IP_ADDRESS_HERE" (country 0)​

I have also installed geoiplookup which I presume uses the same GeoIP.dat file and this works fine...