WAN Deny Rule displays User Portal

Question

I have created a Deny Rule on the WAN zone to block foreign countries and put it at the top of my rules. But instead of dropping connections, it instead will show the User Portal. It doesn't matter if I choose Reject or Deny. This rule worked properly with firmware ver 16.5.08, but since upgrading to ver 17, it has not worked properly. I am currently on ver 17.1.2.

This thread was automatically locked due to age.

Michael Dunn · Accepted Answer

Sorry, I missed some of those details. This is getting out of my area of expertise but... 
 User Portal should only be served on port 443 and only if you are going to an IP of the XG firewall itself (as opposed to going through the firewall to some other destination). It will be served on any port that is in a zone where the zone is configured to allow User Portal. 
 See Administration \ Device Access \ Local Service ACL (Access Control List). By default the User Portal is not enabled for WAN zone. Therefore any incoming connection onto a port IP that is in the WAN zone should follow that Local Service ACL. 
 If you never want User Portal on WAN the remove it there. That should resolve your problem. 
 I don't know in the world of Firewall Rules versus the Local Service ACL which has higher priority. One issue is that there are two special zones that are not shown in the UI that are for local and internal traffic. There are therefore sometimes differences whether you specify the zone "Any" (which includes them) or specify every defined zone (which does not include these special zones).