geoip {
    /* REQUIRED */
    // The path to the .mmdb file you downloaded earlier, notice the path is relative to the Unreal _installation_ directory
    db "data/geolite2-country.mmdb";

    // A list of countries to block, you need at least one for obvious reasons
    block {
        CN; // China
        RU; // Russia
    };

    /* OPTIONAL */
    // Whether to notify opers about anything else besides fatal errors (warnings/errors, blocked/whitelisted connections, etc) -- defaults to yes
    //notifyopers no;

    // Don't even check websocket users, useful in case you already have external access control in place -- defaults to no
    //exemptwebsocket yes;

    // Unknown connections are those for which DB lookup fails (i.e. don't have location data associated with them, such as private/LAN IPs) -- defaults to no
    //allowunknown yes;

    // Process everything as usual but allow the user regardless of failed checks (useful for testing) -- defaults to no
    //softfail yes;

    // Message to show to users if they're denied access for _any reason_ -- defaults to "Denied connection"
    //denymsg "Denied connection due to a blacklisted location";

    /*exceptions {
        // These exempt the possible IP forms of localhost for e.g. bot connections (HOPM/BOPM perhaps), since those are still technically users
        127.0.0.1; ::1;

        // You don't technically need to use this if you're going for the above 2, but I'll add it for completeness =]
        //localhost;

        // Maybe you're hosting your server at home and you're connecting to its local IP and not your public routable (WAN) IP, so exempt your local network too
        192.168.1.0/24;
        //192.168.1.*; // This one would work the same

        // A frequent user is on holiday in Russia, so we gotta let him through
        5.188.63.79;

        // Or someone whose IP is dynamic but his host stays the same, or has multiple IPs but they have the same reverse DNS name (resulting in the same "realhost" value)
        bouncer.bighecks.com;
    };*/
};

// In order to see the notices sent by the module an oper needs to have the +g snomask (/mode nick +s +g or through set::snomask-on-oper or oper::snomask), which also requires a new oper privilege being set:
operclass netadmin-geoip {
    parent netadmin;
    privileges {
        geoip;
    };
};