how to block specific external IP avoiding from VPN login?

Forum|Forum|4 years ago
March 15, 2022
8 replies
6116 views

Hi all, as title, a stranger attempts to login our VPN from a specific external IP such as 85.56.83.8, do you know how to block it? or any other solutions?

Thanks in advance.

Toshi_Esumi

SuperUser

General answer would be "local-in policy" described in below post.

https://community.fortinet.com/t5/Fortinet-Forum/How-to-block-external-IP-to-avoid-connection-from-it-via-VPN/m-p/44500?m=188611

Toshi

sharmaj

Staff

Hi ,

If you have multiple such IPs, you can actually block them using the IP threat feed database and add that into the policy pertaining to VPN.

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/625349/external-block-list-threat-feed-policy

ede_pfau

SuperUser

AFAICT, threat feed cannot be used in local-in policies.

juniorAuthor

Explorer II

is there any other advice?

ede_pfau

SuperUser

local-in policy is the way to go. It's effective and available. What else do you need?

juniorAuthor

Explorer II

Hi, it's like the commands?

config firewall local-in-policy
edit 0
set intf "WAN"
set srcaddr "81.59.52.3"
set dstaddr "all"
set service "ALL"
set schedule "always"

ede_pfau

SuperUser

Yup. Default action is DENY and will not show up using "show", but when you use "show full". Check to be sure.

Over time you will collect some number of 'hostile' public IPs. Put them into an address group and use the group in the local-in policy. This way, to add an address, you only have to edit the group and can leave the policy alone.

Sign up

Login with SSO

Login to the community

Login with SSO