Skip to main content
ForgetItNet
ForgetItNet
Explorer II
April 1, 2023
Solved

Block all traffic from outside the UK

  • April 1, 2023
  • 7 replies
  • 11341 views

Hi all,

 

I can find instructions to block certain IP's but is there a way to ONLY allow traffic in from any location in the UK, i.e so anything (and i mean anything) outside of the UK is blocked by default ?

Thanks

Ian

Best answer by Yurisk

Hi, yes, you can. 

  1.  Create a Geography objects in Addresses: Deleteme1.png
  2. Use it in a Security Rule with an action Deny: Deleteme2.png
  3. Negate this polic for its source addresses. I guess it can be done on CLi only (here my policy number is 3, change to yours): 
config firewall policy     edit 3       set srcaddr-negate enable end

 

7 replies

ForgetItNet
ForgetItNetAuthor
Explorer II
April 1, 2023

That's very easy....one thing i can't figure out though (i'm assuming it's simple and i just can't think) is that how do i set a policy to allow only traffic from here ? obviously i can block traffic from other countries by creating an address with a country in and then selecting block but i don't want to have to manually add all countries so is there a way to set it to allow ONLY from this address ? Do i have to create a group and manually add all the available countries ?

Yurisk
SuperUser
YuriskAnswer
SuperUser
April 1, 2023

Hi, yes, you can. 

  1.  Create a Geography objects in Addresses: Deleteme1.png
  2. Use it in a Security Rule with an action Deny: Deleteme2.png
  3. Negate this polic for its source addresses. I guess it can be done on CLi only (here my policy number is 3, change to yours): 
config firewall policy     edit 3       set srcaddr-negate enable end

 

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    April 1, 2023

    Also, remember that if you have VIPs this should also be included, set match-vip enable if u don't run 7.2.4 that has is by default when a deny rule is created.

    "jack of all trades, master of none"
    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    April 1, 2023

    OP's statements were not clear about what kind of traffic to be blocked. If you want to block like VPN attempts to your FGT itself, not passing through the FGT, you need to do this under "config firewall local-in-policy".

     

    Toshi

    ForgetItNet
    ForgetItNetAuthor
    Explorer II
    April 2, 2023

    Thanks all,

    it's ALL traffic we want to block if that's possible without causing any issues. We don't deal with any location outside of the UK so would want all and everything not from the UK to be blocked so would this just be easier to put in a simple deny rule and then add all the countries available except the UK ?

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    April 2, 2023

    As @Toshi_Esumi rightfully noted - you are not providing us enough of information to recommend something. The block is to be made in Security rules/Local-in Policy/Web filtering/whatever, i.e. it can only be done in context of your Fortigate configuration. "Block traffic non UK without issues" is not a technical requirement, it is a wish which we cannot translate without additional info. 

     

    • DO you want to block access to your internal resources which are accessible via VIPs?
    • Do you want to block outbound from LAN access to non-UK countries as well?
    • Do you want to block access to specific services running on FGT itself (like SSL VPN portal, or admin access or ...)?
    • Do you want this as the only policy - block everything from non-UK AND allow from UK everything, or you have more specific rules controlling traffic as well?

    These are the questions to start with.

    ForgetItNet
    ForgetItNetAuthor
    Explorer II
    April 2, 2023

    Ok, so

    1.I do want to block access to our internal resources which are accessible via any internet facing IP on the router

    2.Yes, i'd like to block outbound to non-uk countries as well

    3.As regards to specific ports...again this is a requirement (if possible) to block EVERYTHING as there's no location inbound or outbound that we need to access or give access to outside of the UK so it would be a complete block on anything in any direction on any port

    4. Yes, i "assume" this would be the only policy so my goal is as you've said....block everything from non-uk and allow everything from uk

    Apologies if I've mis-understood this as i thought it might be a simple case of putting a rule in to say if it's not from the uk then block (whether that's a rule with all the non-uk countires in....otherwise proceed down the firewall rules which it would then do normally ?

    Thanks

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    April 2, 2023

     

     

    1. OK, then as I posted above - you need to use negation of UK GEo object in the top-most security rule in the direction Internet -> Nets-behind-FGT, with the action Deny. This will block on the 1st rule all non-UK sources and will not try to match them against rules below. While source IPs from UK will not match here and continue matching to the rules below.
    2. The same - you put as top-most rule in the direction LAN -> Internet, the rule source LAN destination UK GEO, action Deny, negate the destination on CLI. AS a result this rule will block all packets from LAN to non UK destination addresses and will not try to match such packets to the rules below.
    3. This is a variation of 1) - you also want to block all non-UK sources trying to access services on the FGT itself, here as Toshi mentioned, you have to use Local-in Policy, which on newer versions (at least 7.2x) also allows to use UK as GEO and Block as action, while negating the source. It is configurable on CLI only, shameless plug - you can read more on them Fortigate Local-in policy configuration examples for VPN IPSec, VPN SSL, BGP and more or Google it, there are plenty of examples.
    4. When using GEO addresses, make sure to have valid license on your FGT and that ISDB/IPS are updated regularly for changes in GEO to IPs mappings. 

     

    HTH

     

    Terms & ConditionsAccessibility statement