Base firewall rules everyone should have

[sugita]

What is your opinion the base firewall rules everyone should have for traffic inside -> outside

I often see firewall rule just permit any any inside -> outside, no SSL inspection. No bot net / spam filters, no IPS not IDS.

Why is there no good template fortigate provides that recommends anything -> outside

[AEK]

On top I always add a rule to deny access to IP Reputation ISDB (Blockchain, C&C, Proxy, Tor, ...).

Edit: With "Log Violation Traffic" enabled.

[funkylicious]

i use these for outbound traffic ( LAN > WAN ) and inbound ( WAN > LAN/VIP )

config firewall internet-service-group
    edit "grp_ISDB-Malicious-out"
        set direction destination
        set member "Botnet-C&C.Server" "Malicious-Malicious.Server" "Phishing-Phishing.Server" "Spam-Spamming.Server" "Tor-Exit.Node" "Tor-Relay.Node" "VPN-Anonymous.VPN" "Proxy-Proxy.Server" "Blockchain-Crypto.Mining.Pool"
    next
    edit "grp_ISDB-Malicious-in"
        set direction source
        set member "Botnet-C&C.Server" "Malicious-Malicious.Server" "Phishing-Phishing.Server" "Spam-Spamming.Server" "Tor-Exit.Node" "Tor-Relay.Node" "VPN-Anonymous.VPN" "Shodan-Scanner" "Censys-Scanner" "Stretchoid-Scanner" "InterneTTL-Scanner" "Tenable-Tenable.io.Cloud.Scanner" "NetScout-Scanner" "Recyber-Scanner" "Cyber.Casa-Scanner" "BinaryEdge-Scanner" "UK.NCSC-Scanner" "CriminalIP-Scanner" "Internet.Census.Group-Scanner" "Shadowserver-Scanner" "LeakIX-Scanner" "Proxy-Proxy.Server" "Hosting-Bulletproof.Hosting"
    next
end

[AEK]

I love the idea of the scanners. Thanks Funkylicious.