allowing a country for IPsec remote access vpn

[rezafathi]

Hi

I have configured ipsec remote access vpn and I want to allow only IPs from united kingdom to be able to connect to my FGT. how can i do that?

[funkylicious]

Hi,

Firewall policies are mostly for traffic for inter-interface traffic, for example LAN to WAN, WAN to LAN when using VIPs, etc.

For traffic towards a particular interface, WAN to WAN in your case, you would need local-in policy.

[b34rded-1der]

Firewall policy will only control the traffic traversing the tunnel once it is already established. 

@ebilcari's article is your best bet. Using the address object mentioned earlier, you can use the template below, but there are some caveats: 

1. Best to be as specific as possible with interfaces and services, so you don't lock yourself out of the firewall. If you block all incoming access by accident, you can only fix this via local console. 
2. If you have other IPsec tunnels with static IP or Dynamic DNS peers, you need to add them to the allow rule or you'll break those too. 

config firewall local-in-policy
  edit 0
    set intf "any" # or whatever external interface you use for IPsec VPN. Better to be specific
    set srcaddr "Geo_UK" # maybe create an address group, so you can add any other peers you need without editing the rule directly.
    set dstaddr "all" # or the specific IP listening for IKE requests
    set action accept
    set service "IKE"
    set schedule "always"
  next
  edit 0
    set intf "any" # or whatever external interface you use for IPsec VPN. Better to be specific
    set srcaddr "all"
    set dstaddr "all" # or the specific IP listening for IKE requests
# no need to set an action here, the default is deny
    set service "IKE"
    set schedule "always"
  next
end