ip / country block does not work with waf

Hello,

Drop/Reject Firewall Rules doesn't work with WAF since v18 EAP 1, I've reported it back then but they never fixed It; In v17.5 It used to work as expected.

If you want to open a support case for It, you can use the NC-51857 as reference.

(Read LuCar Toni post below.)

Now you should create a DNAT Blackhole in order to do country filtering for WAF.

Thanks!

I have seen in my environment that MR5 does NOT fix this issue. Very disappointing especially since it took a lot of work to get the maint window approved.

On top of that, I actually had to also roll back to MR4 because development also took "nc" out of the OS which breaks my custom reverse proxy logging solution.

This will not be resolved and is documented in the online help: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/FirewallRulesCountryBasedRuleCreate.html?hl=blocking

I understand that, and I have also crafted the blackhole dnat. That's all fine and well but this also affected the ability to do Outbound country blocking as well.  How can this be resolved? Everything drops fine but HTTP/HTTPS. 

What do you actually want to Archive? The DNAT Rule will pickup the traffic in front of the WAF, therefore it will also drop the traffic coming from those countries and reroute it. That should work for MR5 and MR4. 

Would the any/any on source and destination cover both inbound and outbound traffic?

I put the DNAT inplace to drop inbound access from unwanted countires.

But I'm also looking to block internally originating outbound traffic that tries to propegate to blocked countries.

End users, clients, applications, or malware... The limitation of this 'bug' doesn't intercept outbound 443 or 80 traffic either.

I put the DNAT inplace to drop inbound access from unwanted countires.

But I'm also looking to block internally originating outbound traffic that tries to propegate to blocked countries.

End users, clients, applications, or malware... The limitation of this 'bug' doesn't intercept outbound 443 or 80 traffic either.