Block country but allow specific IP addresses

[okan]

Hello,

I am trying to block all traffic from Russia except Yandex mail. I have an address group for all Yandex IP addresses. Can someone explain why my Allow Yandex rule doesn't get priority and SMTP traffic still trying to go through Country Block rule and getting denied? I am attaching the screenshot.

Thank you very much!

[saneeshpv_FTNT]

@okan 

As a first step, please enable logging in the policy and please check the traffic logs to see what IP is being matched in the deny policy and see if this IP is in your Yandex_IP_Group. Also check the port on the allow policy is matching with the Denied traffic logs.

Best Regards,

Saneesh

[okan]

@saneeshpv_FTNT , hello, thanks for the response. Sure, here is the logs: Logs

And this source address is already specified in the group:

What am I missing here?
Thank you!

[hbac]

Hi @okan,

Are you trying to allow incoming traffic to your SMTP server? When you specify 'all' in the destination, it will not be matched. Please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-VIP-traffic-not-matching-the-firewal...

Regards, 

[okan]

Thank you very much for the response but can't apply match-vip option on an allow policy. I did it on my deny policy but there is no change in behaviour, it was already blocking everything.

We are on 7.4.3 by the way.

[Yurisk · Accepted solution]

By all indications it should work, so I'd recommend to look a bit deeper - like look at debug flow for incoming connections to see the decision flow of the FGT:

dia de reset
dia deb flow filter clear
diagnose debug flow filter addr 178.154.239.0 178.154.239.254
dia deb flow show function
diagnose debug flow trace start 100
dia deb enable

Also, we don't see incoming/outgoing interfaces pairs, so make sure the incoming SMTP traffic enters via the same interface as the rule below. 

To verify:

dia  sni pa any 'net 178.154.239.0/24' 4

[okan]

Hello @Yurisk ,

I have tried your suggestions and apparently incoming traffic wasn't even hitting my allow policy. 

And then @hbac 's response made me think and I modified my allow policy's destination to VIP of mail gateway instead of "all" and then it worked.

Thank you very much for your help, @Yurisk  and @hbac ! 

[Yurisk]

Great to hear, I was somehow thinking your SMTP server has legal IP w/o NAT. 

Please set the question status to "Solved" so other users on forum will look at it first when searching for this type of issue.