Allow only specific set of websites for a ip address

[Ashwin]

Hi, We are using Fortigate 80C with firmware v4.0,build0328,110718 (MR2 Patch 8). I would like to allow only a group of websites to work for a specific ip address and block all other sites. Please help. Ashwin.

[ede_pfau]

hi, welcome to the forums. Create an address group with the specific websites as FQDNs. Use it in a policy from ' internal' to ' wan' as the destination. Specify the source host (as another address object, a single address like 192.168.44.14/32). Fill in service and schedule, enable NAT. Place that policy above all other policies in the policy table which are less specific. Enable the ' Count' column setting to watch traffic hit this policy, and test.

[rwpatterson]

Just below that you will need a policy with the same source(s) and the ' all' destination with a deny, or the following open policy will get hit again allowing web surfing.

[Ashwin]

Thanks for your prompt reply, but I am a beginner so please post a step wise procedure.

[ede_pfau]

Sigh. OK, using the WebGUI:

Create an address group with the specific websites as FQDNs.

Firewall > Address > Address Create New name: server1 // whatever Type: FQDN FQDN: www.allowedserver1.com Interface: Any OK Repeat for every server.

Specify the source host (as another address object, a single address like 192.168.44.14/32).

Now create the source address object: Create New name: mysourcehost // whatever Type: Subnet / IP Range Subnet / IP Range: 192.168.14.77/32 // fill in correct IP address Interface: Any OK Now create an address group: Firewall > Address > Group Create New name: allowed_servers members: select the servers created above OK

Use it in a policy from ' internal' to ' wan' as the destination.

Firewall > Policy > Policy Create New Source Interface: internal Source Address: mysourcehost // whatever specified above Dest. Interface: wan1 Dest. Address: allowed_servers Service: ANY Schedule: always action: ACCEPT NAT: enable OK

Place that policy above all other policies in the policy table which are less specific.

Now you see the Policy Table. Open the section ' internal' ->' wan1' and move the new policy to the top of all policies (right click on policy, ' move' ). This cannot be the only policy, otherwise all other hosts will not be able to reach the internet. So: Firewall > Policy > Policy Create New Source Interface: internal Source Address: mysourcehost // whatever specified above Dest. Interface: wan1 Dest. Address: ALL Service: ANY Schedule: always action: DENY OK Firewall > Policy > Policy Create New Source Interface: internal Source Address: ALL Dest. Interface: wan1 Dest. Address: ALL Service: ANY Schedule: always action: ACCEPT NAT: enable OK Now you have 3 policies. Their sequence must be: 1. allow mysourcehost to allowedservers 2. DENY mysourcehost to anywhere (else) 3. allow ALL (others) to anywhere And now, test.