How do you restrict specific countries from reaching/connecting/anything on an XG Firewall?

Question

So in UTM 9.x, beautifully laid out under "Network Protection > Country Blocking > "List of Country", block From / To or ALL". 
 In SF-OS v18.0.4, no idea. There is the "Hosts and Services > Country Groups", but literally no indicator to know what you should do with these Country Groups. 
 In review, community posts get very garbled in this discussion, but absolutely no clear guidance on what is the best practice unless I am missing something. Can someone explain or point me in the direction of a very simple "How-To Block Countries in SF-OS" guide? 
 Thank you.

FormerMember · Answer

Hi bladefox3 , 
 Thanks for reaching out to the Community! 
 Check out the following document for more info, and let us know if there are any follow-up questions: 
 
 Create a country-based firewall rule 
 
 Thanks,

Fred_B · Answer

It is better to create a country specific DNAT blackhole rule as Firewall rules do not take precedence over system rules. So smtp and waf traffic will not be blocked by a firewall rule. 
 https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/CreateBlackholeDNATRule.html

How do you restrict specific countries from reaching/connecting/anything on an XG Firewall?

Top Replies