The realm's flow with geo.vpn.guard.ip.bypass = 0.0.0.0/0,::/0, exactly what a client's geo_guard: false produces. Shows that an opted-out client admits every address and verdict, exempt or not, without a lookup.
| account \ verdict | SA | GB | SA+vpn | none |
|---|---|---|---|---|
| exempt | admitted | admitted | admitted | admitted |
| not-exempt | admitted | admitted | admitted | admitted |
Your address 216.73.216.102: verdict none (no entry: the stand-in answers 404). The account's exemption: off. Switch them on the lab page.
geo_guard false -> every address: cfg modules/client/main.tf:8-12,142-144; qa docs/location-access.md:94-97 on fahad/docs/location-check-every-login. The bypass is checked after the exemption and before the lookup (qa docs/location-access.md:65-66, src/locationaccess/LocationAccessAuthenticator.java:88-95), and a /0 matches every address of its family (src/common/CidrList.java:117-118), so 'none' is admitted too: nothing is looked up. Lab proof: cfg tests/plugins/test_functional_plugins.py:166 (GB admitted with no lookup; QA023 once the attribute is removed).