Country rules | Kalkan docs

Country rules look only at the country of the address, whatever the connection type. A home connection from a blocked country is stopped just like a VPN.

Two lists

List	Meaning	Command
`country-rules.blocked`	Nobody joins from these countries	`/kalkan country block add CN`
`country-rules.only`	If not empty, only these countries may join	`/kalkan country only add US`

Use remove instead of add to take a country off a list. Codes are two-letter ISO codes. A change works at once and is written to config.yml.

Kalkan's reply in chat: Your countries CA, US; Blocked countries CN; Only these countries may join: no rule, every country — The reply to /kalkan country block add CN. Real capture from a test proxy.

How they fit with the rest

They are checked first, before the connection type.
They follow the mode: in monitor mode a login from a blocked country is recorded as would kick; in block mode, or during an attack, it is kicked.
Only the allow list gets past them. Trusted regulars do not.
An address whose country is unknown is always let in.
With bedrock-check: false, Floodgate players are not checked at all.

What the player sees

Disconnect screen: Kalkan. Joining from China is closed on this server. If you think this is a mistake, contact the server staff. 123.112.0.1, CN, AS4808 — A player from China with CN blocked. Real capture from a test proxy.

The text is country-kick-message in config.yml (MiniMessage). Placeholders: <ip>, <country> (the code), <country_name> (the English name, for example China), <asn>, <org> and <name>.

Typing /kalkan country block add CN, the reply in chat, then a player from China trying to join and being refused — One command, then a player from China tries to join. Real capture from a test proxy.