Sometimes I get asked by clients how to block know attacking countries like Russia, or China from accessing their websites. I often hear that only US connections would be accessing their services so why allow others who might not be on the up and up.
Of course most attackers might pivot from compromised computers in the US, and thus bypass this security feature, but either way its not a bad idea. The below gives a good example on how to create a firewall “country” group and then block those countries from accessing any services hosted through the firewall. This will be done in Forti-OS 5.4.0. Its really the exact same steps in 5.2.
Also, there are many ways to do this. Instead of blocking Geographic regions you could only allow the ones you want to give access to.
Before beginning it might be a great idea to check out the new Fortiview feature to see what countries access your services the most. Under Fortiview- you can now see the countries tab.
Great, so in this example lets block the region of China – I know its not one of the top countries accessing my services.
First lets create the address object that we want to block. In this case I am setting the name of the address object as the country I am blocking. After creating the country object, I will create an address group call “Country blocks” add this to my firewall policy. That way in the future if I want to block Ireland, I can just add that object in the group and I am done.
Creating the address object for “China”. First go to “Policy & Objects” and create a new object.
Next we will fill in the needed info, and change the address type to “Geography”.
Now lets great that group, and add the “China” object to it.
Awesome, now just one more step – creating the firewall policy to block this address group.
Press OK, move this policy to the top of all WAN-LAN or your interfaces policies. This way it gets hit before anything else.
There are more ways than 1 to do this. when allowing traffic into your VIP or policy you could instead specify only the allowed countries.
i’m using 5.4.0, i have to isp one has little bandwidth in international internet connection.
we use load balancing,
i can’t find a way in policy route to route any non local internet connection to a specific isp (since i use wan load balancing).
or is there anyway to configure it in wan load balacing?
Here is CLI commands to quickly create address objects to block geographic regions in FortiGate – http://itadminguide.com/fortigate-block-geographic-regions-using-cli-commands/
i’m using 5.4.0, i have to isp one has little bandwidth in international internet connection.
we use load balancing,
i can’t find a way in policy route to route any non local internet connection to a specific isp (since i use wan load balancing).
or is there anyway to configure it in wan load balacing?
Thanks for the comment! You should be able to do this under the WAN load balancing option. Let me know if you cannot.