Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
nbctcp
New Contributor III

Only Allow SSH from certain country

Let say I have file ID.txt that contain Indonesia ip subnet

223.130.20.0/22 223.164.0.0/16 223.165.4.0/22 223.255.224.0/21

it contains 2700 ips

 

GOALS: 1. only allow SSH from those ID.txt

2. block those ips that from Indonesia that doing Brute Force ssh attack with 5x consecutive failure

 

QUESTIONS:

1. How to achieve that tq

http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
2 Solutions
emnoc
Esteemed Contributor III

Fortigate didn't support like Mikrotik does i.e -Tarpitting https://wiki.mikrotik.com..i/DoS_attack_protection -Port knocking https://wiki.mikrotik.com/wiki/Port_Knocking  

 

No "commercial" firewall that I know of does NOT support port-knocking. Also keep in fail-timeout is a security feature that will deny failed-logins per src-ip. The fact of trsuted host, MFA, changing-admin-port, and elimination of the name admin account is 99.99% of your sys hardening to keep the FGT safe

 

  config sys admin 

 

 (admin) # rename admin to noadmin

 

 (admin) # del noadmin

 

 (admin) # end

 

Do that from the newly created super_admin

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
fernandezm_FTNT

There are a few ways to skin this cat.  Depending on the version of FortiOS you are running.  In 6.2 we introduced "Dynamic Address Lists" you can set up a web-server internally as an example and add the IP addresses you want to block.  The Fortigate will pull the list of IP addresses from the server and create a dynamic address group you can use in your policies. 

 

NOTE: 6.0 had a limited functionality feature where it ONLY worked in conjunction with DNS.  That is, if 1.1.1.1 was a bad guy, and you opened your browser and typed www.goodguy.com and the DNS server responded with 1.1.1.1, it would block it, however if you opened your browser and typed [link]http://1.1.1.1[/link] it would allow you to go.

 

Also noteworthy, if you are using 'Central NAT' you do not have to worry, however if you are using policy NAT and using the vip as the destination IP in your policy, you will need to create a policy containing the all the VIPs you want to protect from the geo list or 'set match-vip enabled'  

 

Check out an article I wrote on both the Dynamic Address Objects and the VIP Issue. As well as a geo script to add all countries

Manny Fernandez Team Lead Systems Engineering Commercial SE, Miami @secprimate fernandezm@fortinet.com www.infosecmonkey.com

View solution in original post

9 REPLIES 9
ede_pfau
Esteemed Contributor III

1. create an address object for each IP

2. create address group(s) (a group may only hold a certain number of addresses, or other groups)

3. create a local-in policy, allowing this address group as source, service=SSH

 

Look here https://www.beneicke-edv.de/support/tools/ for a python script I wrote for exactly this task. The page is in English.


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
nbctcp
New Contributor III

GOALS 1. ANSWERED BY YOU

config firewall address     edit "GEO_ID"         set uuid 992c53f4-ec74-51e9-b083-6714337c388e         set type geography         set country "ID"     next     edit "GEO_SG"         set uuid afcffba6-ec74-51e9-f22b-25a40302a11f         set type geography         set country "SG"     next end   config firewall addrgrp     edit "GEO_ALL"         set uuid c60f7964-ec74-51e9-05e0-0d79566490db         set member "GEO_ID" "GEO_SG"     next end 2. Is there a log that shown SSH brute force attack to FortiGate. Or maybe, I should pump Forti log to external linux syslog and install logwatcher there. So that it can watch specific ssh login failure. then set a script something like this [link]https://forum.fortinet.com/tm.aspx?m=138845[/link]

 

ede_pfau wrote:

1. create an address object for each IP

2. create address group(s) (a group may only hold a certain number of addresses, or other groups)

3. create a local-in policy, allowing this address group as source, service=SSH

 

Look here https://www.beneicke-edv.de/support/tools/ for a python script I wrote for exactly this task. The page is in English.

http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
emnoc
Esteemed Contributor III

Also, you can change the service-port to something not tcp.port 22, that will eliminate 99% of any ssh login password attacks. Also eliminate the default admin account from the "config sys admin" 

 

 

Ken felix

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
nbctcp
New Contributor III

Yeah,

Fortigate didn't support like Mikrotik does i.e

-Tarpitting

https://wiki.mikrotik.com..i/DoS_attack_protection

-Port knocking

https://wiki.mikrotik.com/wiki/Port_Knocking

 

Current Solution: 1. disable ssh on WAN, only enable on LAN

2. admin from outside must use VPN 3. like you said change ssh port change admin user. create blackhole admin user

http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
emnoc
Esteemed Contributor III

Fortigate didn't support like Mikrotik does i.e -Tarpitting https://wiki.mikrotik.com..i/DoS_attack_protection -Port knocking https://wiki.mikrotik.com/wiki/Port_Knocking  

 

No "commercial" firewall that I know of does NOT support port-knocking. Also keep in fail-timeout is a security feature that will deny failed-logins per src-ip. The fact of trsuted host, MFA, changing-admin-port, and elimination of the name admin account is 99.99% of your sys hardening to keep the FGT safe

 

  config sys admin 

 

 (admin) # rename admin to noadmin

 

 (admin) # del noadmin

 

 (admin) # end

 

Do that from the newly created super_admin

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fernandezm_FTNT

There are a few ways to skin this cat.  Depending on the version of FortiOS you are running.  In 6.2 we introduced "Dynamic Address Lists" you can set up a web-server internally as an example and add the IP addresses you want to block.  The Fortigate will pull the list of IP addresses from the server and create a dynamic address group you can use in your policies. 

 

NOTE: 6.0 had a limited functionality feature where it ONLY worked in conjunction with DNS.  That is, if 1.1.1.1 was a bad guy, and you opened your browser and typed www.goodguy.com and the DNS server responded with 1.1.1.1, it would block it, however if you opened your browser and typed [link]http://1.1.1.1[/link] it would allow you to go.

 

Also noteworthy, if you are using 'Central NAT' you do not have to worry, however if you are using policy NAT and using the vip as the destination IP in your policy, you will need to create a policy containing the all the VIPs you want to protect from the geo list or 'set match-vip enabled'  

 

Check out an article I wrote on both the Dynamic Address Objects and the VIP Issue. As well as a geo script to add all countries

Manny Fernandez Team Lead Systems Engineering Commercial SE, Miami @secprimate fernandezm@fortinet.com www.infosecmonkey.com
nbctcp

This  Dynamic Address Objects is interesting, but you said is block.

Let say I have 2000 ip's

What if I want ALLOW from those ip's to ssh to my fortigate

 

fernandezm@fortinet.com wrote:

There are a few ways to skin this cat.  Depending on the version of FortiOS you are running.  In 6.2 we introduced "Dynamic Address Lists" you can set up a web-server internally as an example and add the IP addresses you want to block.  The Fortigate will pull the list of IP addresses from the server and create a dynamic address group you can use in your policies. 

 

NOTE: 6.0 had a limited functionality feature where it ONLY worked in conjunction with DNS.  That is, if 1.1.1.1 was a bad guy, and you opened your browser and typed www.goodguy.com and the DNS server responded with 1.1.1.1, it would block it, however if you opened your browser and typed http://1.1.1.1 it would allow you to go.

 

Also noteworthy, if you are using 'Central NAT' you do not have to worry, however if you are using policy NAT and using the vip as the destination IP in your policy, you will need to create a policy containing the all the VIPs you want to protect from the geo list or 'set match-vip enabled'  

 

Check out an article I wrote on both the Dynamic Address Objects and the VIP Issue. As well as a geo script to add all countries

http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
fernandezm_FTNT

Yes absolutely.  Allow or Block 

Manny Fernandez Team Lead Systems Engineering Commercial SE, Miami @secprimate fernandezm@fortinet.com www.infosecmonkey.com
fernandezm_FTNT

Here is the screenshot from my post,  You can choose the IP address list as a source or destination and choose accept or deny

 

 

Manny Fernandez Team Lead Systems Engineering Commercial SE, Miami @secprimate fernandezm@fortinet.com www.infosecmonkey.com
Top Kudoed Authors