Skip to main content
Ashwin
Ashwin
New Member
October 8, 2013
Question

Allow only specific set of websites for a ip address

  • October 8, 2013
  • 2 replies
  • 22719 views
Hi, We are using Fortigate 80C with firmware v4.0,build0328,110718 (MR2 Patch 8). I would like to allow only a group of websites to work for a specific ip address and block all other sites. Please help. Ashwin.

    2 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    October 8, 2013
    hi, welcome to the forums. Create an address group with the specific websites as FQDNs. Use it in a policy from ' internal' to ' wan' as the destination. Specify the source host (as another address object, a single address like 192.168.44.14/32). Fill in service and schedule, enable NAT. Place that policy above all other policies in the policy table which are less specific. Enable the ' Count' column setting to watch traffic hit this policy, and test.
    rwpatterson
    rwpatterson
    New Member
    October 8, 2013
    Just below that you will need a policy with the same source(s) and the ' all' destination with a deny, or the following open policy will get hit again allowing web surfing.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    October 10, 2013
    Sigh. OK, using the WebGUI:
    Create an address group with the specific websites as FQDNs.
    Firewall > Address > Address Create New name: server1 // whatever Type: FQDN FQDN: www.allowedserver1.com Interface: Any OK Repeat for every server.
    Specify the source host (as another address object, a single address like 192.168.44.14/32).
    Now create the source address object: Create New name: mysourcehost // whatever Type: Subnet / IP Range Subnet / IP Range: 192.168.14.77/32 // fill in correct IP address Interface: Any OK Now create an address group: Firewall > Address > Group Create New name: allowed_servers members: select the servers created above OK
    Use it in a policy from ' internal' to ' wan' as the destination.
    Firewall > Policy > Policy Create New Source Interface: internal Source Address: mysourcehost // whatever specified above Dest. Interface: wan1 Dest. Address: allowed_servers Service: ANY Schedule: always action: ACCEPT NAT: enable OK
    Place that policy above all other policies in the policy table which are less specific.
    Now you see the Policy Table. Open the section ' internal' ->' wan1' and move the new policy to the top of all policies (right click on policy, ' move' ). This cannot be the only policy, otherwise all other hosts will not be able to reach the internet. So: Firewall > Policy > Policy Create New Source Interface: internal Source Address: mysourcehost // whatever specified above Dest. Interface: wan1 Dest. Address: ALL Service: ANY Schedule: always action: DENY OK Firewall > Policy > Policy Create New Source Interface: internal Source Address: ALL Dest. Interface: wan1 Dest. Address: ALL Service: ANY Schedule: always action: ACCEPT NAT: enable OK Now you have 3 policies. Their sequence must be: 1. allow mysourcehost to allowedservers 2. DENY mysourcehost to anywhere (else) 3. allow ALL (others) to anywhere And now, test.
    Terms & ConditionsAccessibility statement