When you need it
Most servers have players from a handful of countries where people speak the server's language. If all other traffic brings only bots and rule breakers, there is no reason to keep the server open to the whole world.
For an international server, or one with many players living abroad, it works the other way round. A wide block would hit your own players, so it makes more sense to close the one or two countries the attacks come from.
Why the filter fails without VPN blocking
A player's country is taken from the address they connect from. With a VPN anyone can pick any country in a couple of clicks, and the filter then sees the country chosen in the VPN instead of the real one. So a country filter only makes sense with the VPN and proxy check turned on, for example on the "Balanced" protection level.
Two modes
The filter is set per server in the panel, on the "Countries" tab of the "Protection" section. The list can hold up to 300 countries.
Only from the selected ones
The server is open only to the listed countries. This is the strictest option and suits local servers. Keep in mind that even your own player cannot join while on holiday abroad until you add them to the whitelist.
Except the selected ones
The server is open to everyone except the listed countries. This option is softer and handy for closing specific countries that attacks come from.
A player from a closed country sees the "Country" message. You can change its text in the panel, and the {COUNTRY} placeholder puts the country name into it.
First see who the filter would hit
In observe mode the country filter kicks nobody and only marks those players in the login log. That way you can see who it would hit before you turn protection on. During a bot attack the server is protected for real even in observe mode, and the filter works too.
Before you set it up, open the login map (from the Basic plan) and look at where your players actually come from.
Close a mobile carrier instead of a country
Sometimes closing a whole country is too blunt, and rule breakers keep coming back through the mobile internet of one carrier. On Pro and higher you can close a specific mobile carrier. Only its mobile internet is blocked, phone hotspots included, while home internet from the same carrier keeps working. The player sees the "Mobile internet" message, and the whitelist still wins.