Block specific tcp/udp port

[Jennyjcuk]

We have a student who i think is using a VPN which uses TCP/UDP 28298 because that's all I see in her Forward traffic reports. Also on O365 it shows me she's a risky user logging in from various different countries!

We have a FortiGate 300E running 6.2.2 Firmware.

Thanks,

Jenny

[Vishalv16]

hi, am not an expert but here what i suggest 1)you can create at service name custom_block_port in objects & security tab then in that service mention the port range for both TCP 28298-28298 & UDP 28298-28298, 2)create new deny policy mention & mention the particular service only in service that that we just created and move this policy at top. 3)Now every traffic goes to those ports will be denied as per policy.(i had tried to block UDP port 80 & 443 for google chrome it worked for me)

[Jennyjcuk]

Thanks @Vishalv16 I have created the custom block port and added it to a new deny policy but it's not blocked for the student i was monitoring still as she is an timed policy further down where it is allowed.  Not sure how that works, as you can't allow and block in the same policy!

[Vishalv16]

right you can't allow & block in same policy. did you move policy at the top as firewall read policy from top to bottom 1st policy will be taken into consideration & next to that even if its deny it will not block traffic as allow policy is above it in list can you share screenshot of your policy what you created  & service as well. Note: if you think its using an VPN  you can add application control filter to policy  then then block all the VPN application(proxy category) to use inside the network. Regards Vishal

[Jennyjcuk]

Yes it's at the top of the policies for that network. 

[Dave_Hall]

Keep in mind when blocking certain ports you will want the destination ports, which I think the fgt defaults to.  Source port(s) should be set as 0-65535.  When first applying such a block you will want to disconnect (end) any currently open sessions directed at those ports.