The realm's flow with geo.vpn.guard.ip.bypass = your address/32, what geo_guard_bypass_cidrs gives a client (F5-stage keeps such a list for its egress). Shows that a listed address skips the lookup whatever it geolocates to.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | admitted | admitted | admitted |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
Same path as geo-opt-out: src/locationaccess/LocationAccessAuthenticator.java:88-95, qa docs/location-access.md:65-66; cfg modules/client/main.tf:12 (geo_guard_bypass_cidrs); F5-stage: qa docs/location-access.md:175-176 on fahad/docs/location-check-every-login. The verdict set for {tester_ip} is never consulted. Holds while Keycloak resolves the login to {tester_ip}: it takes the address from the proxy's X-Forwarded-For (qa docker-compose.yml:54,65; tests/tools/stage_replica/provision_host.sh:96-99). A login over IPv6 or from another network is outside a /32 IPv4 entry (src/common/CidrList.java:105-106) and meets the full guard, as in geo-saudi-only.