Skip to main content
druber
druber
New Member
June 25, 2021
Solved

What is the proper way to block inbound packets from specific hosts?

  • June 25, 2021
  • 1 reply
  • 9926 views

So, kinda new here.  I wanted to block traffic inbound from, say, russia, china and korea.  I set up a firewall rule as wan/lan/GEO/all (where GEO was the geographic list).  No traffic.  So I added another entry as a whitelist from any US traffic, as a positive test.  Still nothing.  Tried changing the dstinf from LAN to any (since I thought maybe the new rule - at the top of the rules list - didn't have a destination, so maybe LAN was wrong.)  Still nothing.  Finally, out of desperation, I created a VIP group, and added the various VIP entries (for my mail server, PBX server, etc...)  Lo and behold, the whitelist entry worked.  So I did the same thing for the GEO-IP blocklist, and that is also now working.  My question: is this really necessary, or am I missing something crucial here?  I've gone through the fortios 6.4.6 manual and saw nothing that spoke to this.  FWIW, I am set in profile mode, not policy mode...  I'm used to pfsense, where nat happens before acl, so you need to check the destination as the internal IP.  But in this case, since I'm trying to block anything from GEO-IP, why didn't 'all' work as a destination?

 

Also, if this IS the correct way to do things, I assume the GEO-IP block rule should be entry #1?

    Best answer by lobstercreed

    This is standard behavior in the FortiGate.  It can easily be fixed by setting "match-vip" to enable in the CLI for the deny policy in question.  This is a very old article that addresses what you're describing:  https://kb.fortinet.com/k....do?externalID=FD36750

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    June 25, 2021

    You don't have any out-to-in policies to allow any pass-through traffic to inside, do you? But want to block random VPN/hack attempts to the outside port(s) of the FGT, I assume. Then you need  to use local-in-policy.

    I found a very convenient article so that I don't have to type more.

    https://conetrix.com/blog/fortigate-local-in-policies-and-geoblocking

     

    druber
    druberAuthor
    New Member
    June 25, 2021

    toshiesumi wrote:

    You don't have any out-to-in policies to allow any pass-through traffic to inside, do you? But want to block random VPN/hack attempts to the outside port(s) of the FGT, I assume. Then you need  to use local-in-policy.

    I found a very convenient article so that I don't have to type more.

    https://conetrix.com/blog/fortigate-local-in-policies-and-geoblocking

    Not sure what you mean by your first sentence?  Anyway, I DNAT several services to inside hosts.  I want to block anything coming from countries specified in the GEO-IP list.  I will check the local-in article you posted.  Thanks!

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    June 25, 2021

    What I meant was routing a public subnet into your network. But if you had DNAT/VIP polices for specific services/ports to allow inbound traffic, and that's all you're concerning about, you've gotten what you wanted already. Local-in-policy would work for other attemps for the services FGT is offering, like HTTPS/SSH admin access, IPSec/SSL VPN, SNMP and so on, which are terminated by the FGT.

    Terms & ConditionsAccessibility statement