Skip to main content
DT3
DT3
New Member
May 9, 2024
Solved

SSL VPN Country Restriction

  • May 9, 2024
  • 2 replies
  • 9111 views

Hi,

 

I have recently tried to restrict our SSL VPN to one specific country. I have created the Geography Object for the country, added it under SSL-VPN Settings, limit access to specific hosts.

Under the SSL-VPN tunnel interface policy the source for IPs was all, so I have changed it to the object I created for the country as I understand the Country has to be set in both places.

The problem I am having is that users can connect, but once connected they cannot access anything. If I take the Country out of the SSL-VPN tunnel interface policy and change back to all it works fine.

As far as I can see I have implemted as recommended so unsure of where to go next. I have tried one two different VPN devices both with public IPs in the country I created.

Best answer by pminarik

Yes, this overrides your general settings. Remove both "set source-address" and "set source-interface", and it will start respecting the GeoIP setting:

...

unset source-address

unset source-interface

end

end

2 replies

pminarik
Staff
pminarik
Staff
May 9, 2024

If by " SSL-VPN tunnel interface policy" you mean the firewall policy in <ssl.root> -> <another interface> direction, then those apply to already-tunneled traffic. The source-address of these policies needs to match the IP the VPN clients get assigned in the tunnel.

Applying geo-IP objects to source-address there is incorrect configuration.

DT3
DT3Author
New Member
May 9, 2024

OK, yes that is what I mean, so is limit access to specific hosts in SSL-VPN settings the only place it needs to be set?

 

Also is it best practice to change the 'All' in Firewall policy ssl.root to reflect the IP the client is assigned over VPN or doesn't it matter?

 

Thanks

pminarik
Staff
pminarik
Staff
May 9, 2024

> so is limit access to specific hosts in SSL-VPN settings the only place it needs to be set?

Yes.
The primary, immediately visible, place to do this restriction is restricting the source-address in general SSL-VPN settings, as you already know.

 

There are two additional advanced options:

- local-in policy (CLI only, config firewall local-in-policy; benefit: not "vulnerable" to the ability to override the visible SSL-VPN setting with CLI-only exceptions in portal mapping rules [config vpn ssl setting > config auth-rule > <here>])

- setting up SSL-VPN on a loopback interface and "routing" to it through a regulard firewall policy (benefit: can apply more types of dynamic address objects)

 

> Also is it best practice to change the 'All' in Firewall policy ssl.root to reflect the IP the client is assigned over VPN or doesn't it matter?

 

In my opinion, this is entirely optional. Anybody who posseses the knowledge required to authenticate to your VPN (username/password/certificate/IP/port/etc) will by default just use whatever IP they were given by the FortiGate, so there's no realistic scenario where setting the SSL-VPN firewall policy would catch something malicious by switching from "all" to "<ssl-vpn-ip-pool>".

esalija
Staff
esalija
Staff
May 9, 2024

Hi @DT3 

 

Thank you for the question.

 

You can make the below configuration on CLI. 

 

Configure firewall address with the geography type.
config firewall address
    edit "restriction_poland"
        set type geography
        set country "PL"  <- Only allows connections from Poland.
    next
end

 

Configure the firewall address group.


config firewall addrgrp
    edit "Geo_restriction_ssl_vpn"
          set member "restriction_poland"
    next
end

 

Configure the firewall address group as the source-address under SSL VPN settings.
config vpn ssl settings
    set servercert "Fortinet_Factory"
    set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
    set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
    set port 444
    set source-interface "wan1"
    set source-address "Geo_restriction_ssl_vpn"
end

 

Please follow the Kb for more details- https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-certain/ta-p/191997

 

Best regards,
Erlin

Terms & ConditionsAccessibility statement