GeoIP

Hi All, 

This issue is currently being investigated with internal ID NC-58436. I will update this post as soon as more information becomes available.

Thank you Peter-Paul Gras for providing support access to your firewall to collect detailed logs and packet capture. 

Thanks,

Hi Peter-Paul Gras 

This is known behavior when the service is destined for the local service on the XG. The firewall rules do not come into effect for the local system. Thus to overcome this, creating a DNAT rule with source as the country group, and follow the instructions outlined in this KB Article : Sophos XG: Creating a blackhole DNAT.

Thanks,

The blackhole DNAT rule does the trick.
Thank you very much for all you and Sophos staff did on this subject. Much appreciated.

Hi Peter,

I tried to create a DNAT rule to block a country access to my WAN Sophos interface without success.

Can you please share with us what did put as parameters.

Thanks in advance.

Regards

Hi Peter,

Never mind, found how to create it.

Thanks.

Hi,

I applied that rule to my v18 XG and ended up with 3 NAT rules of which I deleted 2 because they were not showing any use. 

I knew my XG was being attacked, but just didn't realise how much over 7000 in 6 hours, from the same IP address in Russia using the same source port.

Ian

I have the same problem. Is it like this (link)

I have the same problem. Is it like this (link)

Hi Rijsbol 

Could you please provide the screenshot of your country blocking rule and let me know what service/port you still see traffic from the blocked countries? 

Thanks,

As requested:

NAT Rule

In the Source: BLOCK the country group with Ukraine included.

Hi Rijsbol 

Thank you for providing screenshots of your firewall rules. 

Please change the destination to some other IP address that is not configured in your internal network. The IP address 1.2.3.4 is a magic IP address that is used for Sophos AP registration on the firewall. Also, consider creating a matched drop/reject firewall rule.

Thanks,