CC_DENY="CN,RU,KP" CC_ALLOW="GR,CY,DE"
CC_DENY drops all inbound from those countries. CC_ALLOW is a whitelist: only those countries plus lsf.allow may connect, checked before port rules. An empty CC_ALLOW means whitelist mode is off — leave it empty unless you intend to lock the box to a few countries.
Then Firewall → Refresh GeoIP (lsf -g) and Restart.
