This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How-to create policy to block access to MX from all countries except local

Dear all,

1. My XG is config as my MTA

2. Connection to my MX is only for OWA and Activesync

3. All users only access to OWA and Activesync within the country.

I notice that there are alot 'unwanted' connections direct to my MX via 443 from overseas. Is it possible to setup a policy to block all connection to my MX from all countries except home country?

I do not know exactly what these connections are doing, so I just want to have an extra 'layer' of protection.

Appreciate your kind advise.

Thanks/Jason

This thread was automatically locked due to age.

0 rfcat_vk over 5 years ago

Hi Jason,

does legitimate mail traffic only come from one source, if so add that your mail rule.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 JasonJN over 5 years ago in reply to rfcat_vk

Hi Ian,

Thank you for the prompt reply.

With the current situation, travel is currently not allowed for staff, so yes.. traffic will only be from home country.

What you suggesting is to use the same policy for email and setup the countries to be blocked under "Block Client Network"?

Regards/Jason
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to JasonJN

Hi Jason,

I was thinking that you were talking about your server and limiting the access to your external mail provider assuming you only have one?

if you wish to block country address ranges you will need to build a dnat rule pointing at fictious address.

This thread might help.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/118893/geoip?pi2151=2

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 JasonJN over 5 years ago in reply to rfcat_vk

Hi Ian,

As for now, my objective is to restrict access to my MX via port-443..

I saw the suggestion of using the "Local service ACL exception rule"

Do you think it will work if I setup as below?

Appreciate your advice.

Thanks/Jason
Cancel
Vote Up 0 Vote Down

Cancel