Skip to main content
Azarudeen
Azarudeen
Explorer
June 9, 2025
Question

Allow Specific Subnet from Geo-Blocked Country

  • June 9, 2025
  • 1 reply
  • 636 views

We have an issue allowing a specific subnet from a blocked country. We have a geo-block country firewall policy placed at the top. We have also created an IPsec tunnel with inbound and outbound policies for tunnel communication. However, the remote IP address is a public IPv4 address that belongs to one of the blocked countries.
So how can we allow this subnet. Please suggest the all possible ways.

FortiGate 

    1 reply

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    June 9, 2025

    create an object with that ip/subnet/range and then create a firewall rule allowing access by placing it above the deny rule.

    "jack of all trades, master of none"
    Azarudeen
    AzarudeenAuthor
    Explorer
    June 9, 2025

    If I’m correct, a new policy needs to be created above the existing deny policy.

    I have a couple of questions:

    1. How should I define the source interface (srcintf) and destination interface (dstintf), as well as the source and destination addresses in the new policy

    2. I already have a customized policy for the IPsec VPN connection, but it is placed below the deny policy.

    If I make these changes, will the traffic flow through the new policy? or the existing vpn policy?

    Terms & ConditionsAccessibility statement