Skip to main content
sugita
sugita
New Member
August 11, 2025
Question

Base firewall rules everyone should have

  • August 11, 2025
  • 1 reply
  • 763 views

What is your opinion the base firewall rules everyone should have for traffic inside -> outside

I often see firewall rule just permit any any inside -> outside, no SSL inspection. No bot net / spam filters, no IPS not IDS.

Why is there no good template fortigate provides that recommends anything -> outside

1 reply

AEK
SuperUser
AEK
SuperUser
August 12, 2025

On top I always add a rule to deny access to IP Reputation ISDB (Blockchain, C&C, Proxy, Tor, ...).

Edit: With "Log Violation Traffic" enabled.

AEK
funkylicious
SuperUser
funkylicious
SuperUser
August 12, 2025

i use these for outbound traffic ( LAN > WAN ) and inbound ( WAN > LAN/VIP )

 

config firewall internet-service-group     edit "grp_ISDB-Malicious-out"         set direction destination         set member "Botnet-C&C.Server" "Malicious-Malicious.Server" "Phishing-Phishing.Server" "Spam-Spamming.Server" "Tor-Exit.Node" "Tor-Relay.Node" "VPN-Anonymous.VPN" "Proxy-Proxy.Server" "Blockchain-Crypto.Mining.Pool"     next     edit "grp_ISDB-Malicious-in"         set direction source         set member "Botnet-C&C.Server" "Malicious-Malicious.Server" "Phishing-Phishing.Server" "Spam-Spamming.Server" "Tor-Exit.Node" "Tor-Relay.Node" "VPN-Anonymous.VPN" "Shodan-Scanner" "Censys-Scanner" "Stretchoid-Scanner" "InterneTTL-Scanner" "Tenable-Tenable.io.Cloud.Scanner" "NetScout-Scanner" "Recyber-Scanner" "Cyber.Casa-Scanner" "BinaryEdge-Scanner" "UK.NCSC-Scanner" "CriminalIP-Scanner" "Internet.Census.Group-Scanner" "Shadowserver-Scanner" "LeakIX-Scanner" "Proxy-Proxy.Server" "Hosting-Bulletproof.Hosting"     next end
"jack of all trades, master of none"
    AEK
    SuperUser
    AEK
    SuperUser
    August 12, 2025

    I love the idea of the scanners. Thanks Funkylicious.

    AEK
      Terms & ConditionsAccessibility statement