Block internet access with web filter

[GustavoDecenci]

Hi everyone!

I'm facing a specific need and would appreciate some help to understand the best way to configure this in FortiGate.

I need to completely block internet access for a specific IP range, and then allow access only to certain websites as needed.

Currently, I'm handling this using a Web Filter with the URL Filter option. Within the URL Filter, I have a rule that blocks all access, and above it, I add the URLs that need to be allowed. This Web Filter profile is applied to a firewall policy for the range.

This setup is working fine to allow access to sites for the entire range, but now I need to allow a specific site for only one IP, without affecting the rest of the IPs in the range, which must remain blocked.

My question is: what’s the best way to implement this kind of per-IP exception using Web Filter, without affecting the general rule that is already working for the rest of the range?

Thanks in advance for any help!

[Toshi_Esumi]

If it's "IP-based" filtering, the best way is to allow specific IPs for HTTPS/HTTP with one policy, then deny any/all IPs(dst address) for HTTPS/HTTP for the next policy for the src/dst interface pair.

Toshi

[GustavoDecenci]

I do this for some exceptions but I need to make some exceptions with wildcard or regular expressions.

[Toshi_Esumi]

You can define address objects with wildcard FQDNs then use them in policies.
https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/217973/using-wildcard-fqdn-a...

Toshi

[GustavoDecenci]

I know I can use it this way, but it's not what I need.

For example, I need to release a site that would be an online SharePoint site for a team.

https://mycompany.sharepoint.com/sites/TI

But I have several other sites at the same level, for example:

https://mycompany.sharepoint.com/sites/Finance

But I only need to release the IT site, so I use the web filter with the URL filter enabled to release it.

mycompany.sharepoint.com/sites/TI*

If I release it by FQDN, I'll be releasing the entire SharePoint site, so I need to block and release it using the web filter.

[TE]

Then, that's NOT IP-based.You have to use static URL filters to "exempt" those specfic URL first then block everything else, like with regex ".*".
https://community.fortinet.com/t5/FortiGate/Technical-Tip-URL-Filter-expressions-for-the-FortiGate/t...

Toshi