Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Alhokair
New Contributor

Block Specific IP Addressess of Accessing Firewall from Outside

I created firewall policy that blocking list of IP addresses using threat feeds but that policy not blocking same IP addresses of accessing firewall itself through public IP and always they try to login.

 

How I can prevent these list of IP addresses of accessing firewall ?

8 REPLIES 8
funkylicious
Contributor III

Hi,

That can be done through local-in policy, from CLI.

geek
geek
isamt
Contributor

Apply policy as below:

 

Create the Local in Policy to restrict access only to the predefined group on management interface (here: port1):

 

config firewall local-in-policy

edit 1

set intf port1

set srcaddr "MGMT_IPs"

set dstaddr "all"

set action accept

set service HTTPS HTTP

set schedule "always"

set status enable

next

edit 2

set intf "any"

set srcaddr "all"

set dstaddr "all"

set action deny

set service HTTPS HTTP

set schedule "always"

set status enable

end

 

If using non default ports, create appropriate service object for GUI administrative access:

 

config firewall service custom

edit GUI_HTTPS

set tcp-portrange <admin-sport>

next

edit GUI_HTTP

set tcp-portrange <admin-port>

end

 

Use these objects instead of "HTTPS HTTP "in the local-in policy 1 and 2 below.

Alhokair
New Contributor

brother Isamt,

 

I'm not able to do same local policy because I'm connecting to this firewall using SD-WAN interfaces and within these WAN interfaces there shared internet which not specifying the public IP for that reason I'm not able to use your custom configuration.

 

 

ede_pfau
Esteemed Contributor III

Please don't use the "any" interface! You know which interface is connected to the WAN, use the specific port.

The side-effect of using the "any" interface (which must be enabled specifically first) is that you lose the 'interface pair view' in the policy table. And life get's a lot more difficult when debugging.


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
Alhokair

You are right while I'm connected by public IP it will be difficult to change port while I tried to enable HTTP and I change port number but I wasn't able to access it for that reason I need know how I can disable access to firewall from list of IP's.

isamt
Contributor

You should be able to do what you want using the config firewall local-in-policy 

If you enter set int ? you will get a list of all available interfaces that the policy can be applied to. If you just want to block access from a set of IP's then create a group and add the IP's to deny in there.

Then config policy to deny anything in the group and allow what you do want etc.

 

Oh and you do need to specify the interface so in my example edit 2 should reference port1 as well so code allows traffic to port1 for anything in the MGMT_IPs group and denies all other traffic going to port1 using ports HTTP, HTTPS 

 

aasif
Staff
Staff

How about configuring trusted hosts?

AA
aasif
Staff
Staff

This Below link tells you how to configure local in policy:

https://docs.fortinet.com/document/fortigate/6.2.13/cookbook/363127/local-in-policies
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Filter-ingress-traffic-going-to-the-FortiG...


A few things I could recommend:
1 Disable any protocol access from your WAN port that's not needed 
2. Change the default port numbers 
3. Use 2-factor authentication for all the admin logins (the FortiGate comes with two free mobile tokens)
4. If you know the IP address that you'll be connecting from for the admin access, then add these to the trusted hosts (configured under each administrator account)= Already done

AA
Labels
Top Kudoed Authors