So, kinda new here. I wanted to block traffic inbound from, say, russia, china and korea. I set up a firewall rule as wan/lan/GEO/all (where GEO was the geographic list). No traffic. So I added another entry as a whitelist from any US traffic, as a positive test. Still nothing. Tried changing the dstinf from LAN to any (since I thought maybe the new rule - at the top of the rules list - didn't have a destination, so maybe LAN was wrong.) Still nothing. Finally, out of desperation, I created a VIP group, and added the various VIP entries (for my mail server, PBX server, etc...) Lo and behold, the whitelist entry worked. So I did the same thing for the GEO-IP blocklist, and that is also now working. My question: is this really necessary, or am I missing something crucial here? I've gone through the fortios 6.4.6 manual and saw nothing that spoke to this. FWIW, I am set in profile mode, not policy mode... I'm used to pfsense, where nat happens before acl, so you need to check the destination as the internal IP. But in this case, since I'm trying to block anything from GEO-IP, why didn't 'all' work as a destination?
Also, if this IS the correct way to do things, I assume the GEO-IP block rule should be entry #1?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
This is standard behavior in the FortiGate. It can easily be fixed by setting "match-vip" to enable in the CLI for the deny policy in question. This is a very old article that addresses what you're describing: https://kb.fortinet.com/k....do?externalID=FD36750
You don't have any out-to-in policies to allow any pass-through traffic to inside, do you? But want to block random VPN/hack attempts to the outside port(s) of the FGT, I assume. Then you need to use local-in-policy.
I found a very convenient article so that I don't have to type more.
https://conetrix.com/blog/fortigate-local-in-policies-and-geoblocking
toshiesumi wrote:Not sure what you mean by your first sentence? Anyway, I DNAT several services to inside hosts. I want to block anything coming from countries specified in the GEO-IP list. I will check the local-in article you posted. Thanks!You don't have any out-to-in policies to allow any pass-through traffic to inside, do you? But want to block random VPN/hack attempts to the outside port(s) of the FGT, I assume. Then you need to use local-in-policy.
I found a very convenient article so that I don't have to type more.
https://conetrix.com/blog/fortigate-local-in-policies-and-geoblocking
What I meant was routing a public subnet into your network. But if you had DNAT/VIP polices for specific services/ports to allow inbound traffic, and that's all you're concerning about, you've gotten what you wanted already. Local-in-policy would work for other attemps for the services FGT is offering, like HTTPS/SSH admin access, IPSec/SSL VPN, SNMP and so on, which are terminated by the FGT.
toshiesumi wrote:Makes sense, thanks. Yes, in fact I have a dynamic residential IP, and there are zero services on the FGT itself to be accessed from the WAN.What I meant was routing a public subnet into your network. But if you had DNAT/VIP polices for specific services/ports to allow inbound traffic, and that's all you're concerning about, you've gotten what you wanted already. Local-in-policy would work for other attemps for the services FGT is offering, like HTTPS/SSH admin access, IPSec/SSL VPN, SNMP and so on, which are terminated by the FGT.
Almost forgot: do you have any idea why it didn't work when I gave all for the Destination, and required a VIP or VIP group? Bug?
This is standard behavior in the FortiGate. It can easily be fixed by setting "match-vip" to enable in the CLI for the deny policy in question. This is a very old article that addresses what you're describing: https://kb.fortinet.com/k....do?externalID=FD36750
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.