Block Specific IP Addressess of Accessing Firewall from Outside

[Alhokair]

I created firewall policy that blocking list of IP addresses using threat feeds but that policy not blocking same IP addresses of accessing firewall itself through public IP and always they try to login.

How I can prevent these list of IP addresses of accessing firewall ?

[funkylicious]

Hi,

That can be done through local-in policy, from CLI.

[isamt]

Apply policy as below:

Create the Local in Policy to restrict access only to the predefined group on management interface (here: port1):

config firewall local-in-policy

edit 1

set intf port1

set srcaddr "MGMT_IPs"

set dstaddr "all"

set action accept

set service HTTPS HTTP

set schedule "always"

set status enable

next

edit 2

set intf "any"

set srcaddr "all"

set dstaddr "all"

set action deny

set service HTTPS HTTP

set schedule "always"

set status enable

end

If using non default ports, create appropriate service object for GUI administrative access:

config firewall service custom

edit GUI_HTTPS

set tcp-portrange <admin-sport>

next

edit GUI_HTTP

set tcp-portrange <admin-port>

end

Use these objects instead of "HTTPS HTTP "in the local-in policy 1 and 2 below.

[Alhokair]

brother Isamt,

I'm not able to do same local policy because I'm connecting to this firewall using SD-WAN interfaces and within these WAN interfaces there shared internet which not specifying the public IP for that reason I'm not able to use your custom configuration.

[ede_pfau]

Please don't use the "any" interface! You know which interface is connected to the WAN, use the specific port.

The side-effect of using the "any" interface (which must be enabled specifically first) is that you lose the 'interface pair view' in the policy table. And life get's a lot more difficult when debugging.

[Alhokair]

You are right while I'm connected by public IP it will be difficult to change port while I tried to enable HTTP and I change port number but I wasn't able to access it for that reason I need know how I can disable access to firewall from list of IP's.

[isamt]

You should be able to do what you want using the config firewall local-in-policy 

If you enter set int ? you will get a list of all available interfaces that the policy can be applied to. If you just want to block access from a set of IP's then create a group and add the IP's to deny in there.

Then config policy to deny anything in the group and allow what you do want etc.

Oh and you do need to specify the interface so in my example edit 2 should reference port1 as well so code allows traffic to port1 for anything in the MGMT_IPs group and denies all other traffic going to port1 using ports HTTP, HTTPS 

[aasif]

How about configuring trusted hosts?

[aasif]

This Below link tells you how to configure local in policy:

https://docs.fortinet.com/document/fortigate/6.2.13/cookbook/363127/local-in-policies
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Filter-ingress-traffic-going-to-the-FortiG...


A few things I could recommend:
1 Disable any protocol access from your WAN port that's not needed 
2. Change the default port numbers 
3. Use 2-factor authentication for all the admin logins (the FortiGate comes with two free mobile tokens)
4. If you know the IP address that you'll be connecting from for the admin access, then add these to the trusted hosts (configured under each administrator account)= Already done