diff --git a/nginx-config.configmap.yaml b/nginx-config.configmap.yaml
index 625f7e2..1a80cc5 100644
--- a/nginx-config.configmap.yaml
+++ b/nginx-config.configmap.yaml
@@ -14,7 +14,12 @@ data:
     \       log_format ip_audit '$remote_addr [$time_local]';\n        log_format
     backend_debug '$remote_addr - $remote_user [$time_local] '\n                             '\"$request\"
     $status $body_bytes_sent '\n                             '\"$http_referer\" \"$http_user_agent\"
-    '\n                             'upstream_status=$upstream_status';\n\n\tserver
+    '\n                             'upstream_status=$upstream_status';\n        log_format
+    localization '$remote_addr - $remote_user [$time_local] '\n                '\"$request\"
+    $status $body_bytes_sent '\n                '\"$http_referer\" \"$http_user_agent\"
+    '\n                '$geoip2_data_city_name $geoip2_data_country_name';\n\tlog_format
+    blocked_fmt '$http_host \\t $remote_addr - [$time_local] '\n\t\t'Blocked Country:
+    $geoip2_data_country_iso_code '\n                '\"$request\" $status';\n\n\tserver
     {\n\tlisten 80;\n        listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem;
     # managed by$\n        ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem;
     # managed $\n        location / {\n            proxy_pass         http://1.1.1.1;\n
@@ -26,16 +31,14 @@ data:
     /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
     iso_code;\n\t        $geoip2_data_city_name city names en;\n\t        $geoip2_data_country_name
     country names en;\n\t}\n     \n\tmap $geoip2_data_country_iso_code $allowed_country
-    {\n\t\tdefault yes;\n\t\tIN no;\n\t        CN      no;  # Block China\n\t\tRU
-    \     no;  # Block Russia\n\t\tKP      no;  # Block North Korea\n\t}\n\tlog_format
-    main_ext '$remote_addr - $remote_user [$time_local] '\n\t\t'\"$request\" $status
-    $body_bytes_sent '\n                '\"$http_referer\" \"$http_user_agent\" '\n
-    \               '$geoip2_data_city_name $geoip2_data_country_name';\n\n\n\t#add_header
-    X-Country-Code \"$geoip2_data_country_code\" always;\n\n\tinclude /etc/nginx/deny.d/*.conf;\n\tinclude
-    /etc/nginx/conf.d/*.conf;\n        include /etc/nginx/blacklisted.d/*.conf;\n\n\t#
-    adding this line for the fial2ban settings\t\n        #map  $cookie_session_id
-    $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }\n\t#add
-    extra file for any extra work \n        include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
+    {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; # Allow UK\n                #NL
+    \    yes; # Allow netherland\n\t\t#IN\tyes;  # Allow India\n\t}\n\t# Full list
+    of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap
+    $allowed_country $should_log_blocked {\n\t\tno       1;\n\t\tdefault 0;\n\t}\n\n\tinclude
+    /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n        include
+    /etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n
+    \       #map  $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map;
+    }\n\t#add extra file for any extra work \n        include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
     127.0.0.1 ipv6=off valid=40s;  # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path
     /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n"
 kind: ConfigMap
diff --git a/nginx.conf b/nginx.conf
index 7aae8be..b681ba5 100755
--- a/nginx.conf
+++ b/nginx.conf
@@ -31,7 +31,9 @@ http {
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent" '
                 '$geoip2_data_city_name $geoip2_data_country_name';
-
+	log_format blocked_fmt '$http_host \t $remote_addr - [$time_local] '
+		'Blocked Country: $geoip2_data_country_iso_code '
+                '"$request" $status';
 
 	server {
 	listen 80;
@@ -62,16 +64,18 @@ http {
      
 	map $geoip2_data_country_iso_code $allowed_country {
 		default no;
-		#NL	yes; # Allow netherland
 		FR	yes; # Allow France
 		GB	yes; # Allow UK
-		NL	no;  # Block netherland
-		IN	no;  # Block India
-	        CN      no;  # Block China
-		RU      no;  # Block Russia
-		KP      no;  # Block North Korea
+                #NL     yes; # Allow netherland
+		#IN	yes;  # Allow India
 	}
 	# Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes
+
+	map $allowed_country $should_log_blocked {
+		no       1;
+		default 0;
+	}
+
 	include /etc/nginx/deny.d/*.conf;
 	include /etc/nginx/conf.d/*.conf;
         include /etc/nginx/blacklisted.d/*.conf;
diff --git a/terraform/nginx_config.tftpl b/terraform/nginx_config.tftpl
index 161fb89..4cddf1a 100644
--- a/terraform/nginx_config.tftpl
+++ b/terraform/nginx_config.tftpl
@@ -9,6 +9,12 @@ upstream ${name_site}_backend {
 
 server {
         server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
+        if ($allowed_country = no) {
+            return 444; # Forbidden
+            # Or use 'return 444;' to close the connection without a response
+	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
+        }
+
         location / {
                 proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
                 proxy_set_header    Upgrade     $http_upgrade;
@@ -31,10 +37,17 @@ server {
         location /.well-known/acme-challenge/ {
                 root /var/www/certbot;
         }
+	location @f2b-banned {
+	       default_type text/html;
+	       return 403 "<br/><center>
+	         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
+	         You are banned!</b></center>";
+	     }
 
 	access_log /var/log/nginx/access.log my_custom_format;
         access_log /var/log/nginx/ip_audit.log ip_audit;
         access_log /var/log/nginx/backend_debug.log backend_debug;
+        access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked; 
 	${extra-value}
         %{~ if http2_bool~}
         http2 on;
diff --git a/terraform/variables.auto.tfvars b/terraform/variables.auto.tfvars
index dd02889..3aedaad 100644
--- a/terraform/variables.auto.tfvars
+++ b/terraform/variables.auto.tfvars
@@ -1,13 +1,13 @@
 nginx_sites = {
   bitwarden = {
-    service = "nginx.bitwarden.svc:8080"
+    #service = "nginx.bitwarden.svc:8080"
     #extra-value-location = <<EOT
     #proxy_set_header      Host $host;
     #proxy_set_header      X-Real-IP $remote_addr;
     #proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
     #proxy_set_header      Proxy "";
     #            EOT
-    #service    = "bitwarden-nginx-svc.bitwardent.svc:8080"
+    service    = "bitwarden-nginx-svc.bitwarden.svc:8080"
     http2_bool = true
   }
 
@@ -36,38 +36,38 @@ nginx_sites = {
     proxy_cache = true
     http2_bool  = true
 
-    extra-value-location = <<EOT
-      auth_request /oauth2/auth;
-      error_page 401 = @oauth2_signin;
-      proxy_set_header X-Auth-Request-Redirect $request_uri;
-                EOT
+    #extra-value-location = <<EOT
+    #  auth_request /oauth2/auth;
+    #  error_page 401 = @oauth2_signin;
+    #  proxy_set_header X-Auth-Request-Redirect $request_uri;
+    #            EOT
 
-    extra-value = <<EOT
-      location = /oauth2/auth {
-      internal;
-proxy_pass http://oauthn_backend;
-#        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
-      proxy_pass_request_body off;
-      proxy_set_header Content-Length "";
-      proxy_set_header X-Original-URI $request_uri;
-      proxy_set_header X-Real-IP $remote_addr;
-      proxy_set_header X-Scheme $scheme;
-    }
+    #extra-value = <<EOT
+    #  location = /oauth2/auth {
+    #  internal;
+#proxy_pass http://oauthn_backend;
+##        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
+    # proxy_pass_request_body off;
+    #  proxy_set_header Content-Length "";
+    #  proxy_set_header X-Original-URI $request_uri;
+    #  proxy_set_header X-Real-IP $remote_addr;
+    #  proxy_set_header X-Scheme $scheme;
+    #}
 
-    location @oauth2_signin {
-      return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
-      #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
-    }
+    #location @oauth2_signin {
+    #  return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
+    #  #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
+    #}
 
-    location /oauth2/ {
-    proxy_pass http://oauthn_backend;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Scheme $scheme;
-    proxy_set_header X-Auth-Request-Redirect $request_uri;
-    }
+    #location /oauth2/ {
+    #proxy_pass http://oauthn_backend;
+    #proxy_set_header Host $host;
+    #proxy_set_header X-Real-IP $remote_addr;
+    #proxy_set_header X-Scheme $scheme;
+    #proxy_set_header X-Auth-Request-Redirect $request_uri;
+    #}
 
-                EOT
+    #            EOT
 
 
   }
@@ -75,6 +75,7 @@ proxy_pass http://oauthn_backend;
     service          = "webserver.gitlab.svc:443"
     proxy_cache      = true
     extra_value_bool = true
+    enabled          = false
     extra-value      = <<EOT
 client_max_body_size 20m;
 	proxy_request_buffering off;
@@ -192,6 +193,7 @@ client_max_body_size 20m;
   }
   dupeguru = {
     service                 = "dupeguru.dupeguru.svc:5800"
+    enabled                 = false
     authentication_required = true
   }