Newbe! Help required to restrict 1 IP address

[solidblueliquid]

Hi Everyone,

I have a fortigate 100D and need help configuring a rule correctly. I have 1 IP address that is the root IP of a server (its a Xenserver). I want to restrict access to this server to only a subnet of IP addresses and 1 specific one, for example;

1.1.1.1/24

1.1.1.1

Nothing else should be able to talk to that device. I'm on firmware v5.6.0, currently in my addresses I have a group called Servers which covers the IP addresses that are assigned to all the potential servers, I'm assuming if I split this into, Xenserver and Servers then i can lock down the Xenserver address specifically?

Any help would be appreciated, i don't want to do this blind as the server is an hour away by car and would rather not have to go there everytime i wanted to do anything

Thanks

[sw2090]

hiho,

at first: in your example your specific ip is a part of the subnet. 

1.1.1.1/24 would anyhows have 1.1.1.1 as network address so that would not be a host :D

1.1.1.1/24 would additionaly not be a vaild subnet hence it would not have 255 addresses.

So let me assume you meant 1.1.1.0/24 and 1.1.1.1.

Then 1.1.1.1 would be a valid host and is part of 1.1.1.0/24.

So if you want to restrict the server to 1.1.1.0/24 you have to create an object for this subnet.

Then make a policy with the following:

Source-Address is you subnet 1.1.1.0/24 (referenced by the object you created in the step before)

Source-Interface will be the interface of the fortigate where the traffic of 1.1.1.0/24 comes in.

Destination-Address will bei the IP of your server (also referenced by an object).

Destination-Interface will bei the interface via wich your server is to be reached.

Since FortiOS 5.4 you are btw able to create Objects from within the selection menue!

If there are more Policies that grant access to the subnet the server is in or the server itself you have to take care of the order of the policies. FortiOS will stop applying policies one one was matched!

So if you already have a policy that denies access to the server from everywhere than all policies that grant access have to come before it! 

So you need:

- Policy that allows traffic from 1.1.1.0/24 to server

- Policy that allows traffic from specific ip to server (that is not in 1.1.1.0/24)

- Policy that denies all access to server

if your specific ip is in 1.1.1.0/24 the first policy will already match so the second and third will no more be aplied.

[solidblueliquid]

Sorry that was a bad example... i was using 1.1.1.1 as blank address rather than a real one.

I see where your example goes, and if I wanted to allow access to the server from another address I would just have to add another ALLOW in the policy?

[sw2090]

Probably this will do but I never did that way. 

I prefer using an own policy for each host or net because on the policy overwie you have a better overview then.

Because on our main Fortigate I have 32 ipsec tunnels that have policies that give me access to specific subnets over each one of them so this escalates rather quickly ;)

But yes FortiOS supports adding more objects as source or destination on one policy. So you could do this.

You could also group objects and then use the group as source or destination. In this case you just need to add a new host or subnet to that group and not even touch any policy :)

[rwpatterson]

A caveat: If the server is on the same subnet as the stations trying to reach it, traffic will not pass through the Fortigate and they will not be blocked.

[sw2090]

yes indeed you're right Bob. Tnx for mentioning that as I forgot about it ;)

[solidblueliquid]

Okay, let me put this with more realisitic addresses and the actual setup (the ips will be different from the real)

Xenserver is on 22.52.123.80

VPS1 is on 22.52.123.81

VPS2 is on 22.52.123.82

VPS3 is on 22.52.123.83

VPS4 etc...

Final VPS is on 22.52.123.108

The xenserver has 4 ethernet cables, 3 are bound and go straight to the firewall, the 4 bypasses the firewall but is currently deactivated

The firewall already has policies in place protecting 81 - 108.

So i need it to accessible from the office at 42.52.57.23 and no one else... but the rest need to be protected etc. Does that make any better sense, or have i made it worse? There is no reason (i can see) why the VPS need to talk to Xenservers admin panel, it would also mean i could turn ssh on as then only we'll be able to access it

[rwpatterson · Accepted solution]

In the Fortigate firewall world, the device can only be reached if there is a policy in place, so if you only create a policy for that one IP pair, then the others will automatically be protected. Hope that answers your query. One policy from 42.52.57.23 to 22.52.123.108 and you should be fine.

[sw2090]

Yes that is because at the bottom of the policy tree there is always policy #0 that denies everything to everywhere per default.

So indeed you only need policies to make accessible what you want to be accessible since what don't match any policy will match Policy #0 :)