Technical Tip: Blocking Inbound Access from Specific Country IP Ranges on FortiGate

[jhelder]

Description	This article describes a practical approach to safeguarding the network by denying connections from IPs originating in China. However, it is important to note that this method can be applied to block connections from any country, providing an additional layer of defense against potential threats. It is possible to effectively block or deny all connection attempts originating from undesired countries.
Scope	FortiGate.
Solution	Verify 'Local in Policy' Enablement: Navigate to 'System' and access 'Feature Visibility'. Confirm whether 'Local in Policy' is enabled.  Proceed to 'Policy and Object' and select 'Addresses'. Choose to create a new address object to define the IP ranges for the specific country to block. Create the Local-in Policy using the CLI: Configure the local-in policy by setting the appropriate parameters: Specify the previously created address object as the source for the policy. Define the desired interface and services to be affected. For instance, if 'port1' serves as a WAN interface. And in the service, it is all defined, because it is necessary to block all connections coming to the firewall in any port number. By following these steps, it is possible to effectively block connections originating from specific country IP ranges, ensuring enhanced security for the FortiGate. The next tip on the same topic is a bonus tip in case there is a need to allow only one country to connect to the firewall and all of the other countries to be blocked. In this example, all of the countries except China will be blocked :   The following is achieved with the use of 'set srcaddr-negate enable' which would block all of the addresses except the one configured in 'srcaddr'. One friendly reminder is that the default action in local policies is denied, therefore there is no need to configure it. Note: From v7.6.x, local-in policy can be configured on GUI under Policy & Objects -> Local-in Policy. From v7.4.6 there is a behavior change in the interface selection in Local-in policy. if the interface is a member of the SD-wan Zone then that individual interface cannot be selected in Local-in-policy. The solution is to configure the Local-in policy with the interface as the SD-Wan zone instead of the individual interface. This behavior also affects when FortiGate is upgraded from any previous version to v7.4.6 the Local-in policy which is configured with an individual interface will be deleted after the upgrade it has to be manually configured again with the interface as the SD-WAN zone    Related documents: Local-in policy  Firewall-Policy-Negate-option Technical Tip: ESP Packets are not blocked by local-in policy