Skip to main content
OFIvolve
OFIvolve
New Member
November 27, 2019
Question

External Malicous IPs hitting on Wan Interface

  • November 27, 2019
  • 1 reply
  • 2914 views
Hi,

I am seeing a lot of external malicious IPs as source in Traffic-Local logs to my wan interface on port 80. How can I block a list of different external IPs on my wan interface. If I configure a local-in-policy for blocking port 80 wan interface, will it block my other traffic for port 80? We are running an application on both port 80 and 443.

Regards

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 27, 2019

    Well, port 80 (and port 443) open on a firewall's external port should be very, very well weighted. Sometimes you can shift those well known port numbers to a high range (50000+), letting the VIP 'down transform' that to the original port on the inside.

    Apart from that, you could tailor the local-in policy with appropriate source address (whitelisting) instead of 'all'. Other than that, consider using a secure access via VPN. I take it that you have already disabled HTTP and HTTPS access on the WAN port, of course.

    OFIvolve
    OFIvolveAuthor
    New Member
    November 27, 2019

    If I configure a local-in-policy for blocking port 80 wan interface, will it block my other traffic for port 80?

    Terms & ConditionsAccessibility statement