Outbound traffic block

[tmoe]

How would you recommend blocking all outbound traffic from a single internal IP? The same IP has incoming services for FTP and another custom service already. I want this server to ONLY be able to communicate in or out over the 2 services I specify. Thanks in advance, Tmoe

[emnoc]

Install a fwpolicy as a specific entry before any allow ANY/ALL , with a deny any for that ip_address & outbound.

[rwpatterson]

BEFORE the deny, you need to install an allow (outward) for the protocols you require, THEN the deny all (others) from that single IP. Just the deny will... deny!

[tmoe]

Perfect! I used 3 policies. 1 to allow the specific services in to the server. 1 to allow the specific services out of the server. 1 to deny all traffic to the server. I put them in that order as well. Works like a champ! My LAN is port13 WAN is port14

[emnoc]

noted Also nailing it behind a VIP would have gave you the same thing and no local fwpolicies for that src and only the inbound VIP fwpolicies