Thread Info
  • State Suggested Answer
  • +7 person also asked this people also asked this
  • Locked Locked
  • Replies 58 replies
  • Answers 4 answers
  • Subscribers 49 subscribers
  • Views 191201 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Country Blocking Not Working for a WAN > LAN Rule

Timothy Stewart

Hi.  It seems like country blocking is not working for WAN -> LAN (or any other protected network behind XG Firewall).

I have tested this with a proxy in the blocked countries.

I have this rule at the top of the list and network traffic still passes even though the rule shouldn't allow it, basically ignoring it.  The rule is never triggered thus always stating in 0 B, out 0 B.  I have tried every combination of Source/Destination/Zone/Network and still it doesn't work.



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to sachingurung

    Hi there.  This does not address my concern.  I have also posted in that same thread and was asked to create a new thread after the bug was confirmed.   Please see my post in that thread and the response from a sales engineer.  This is confirmed to be broken when trying to protect WAN>LAN.  It works for protecting XG FIrewall services though with a local ACL.

  • 0 in reply to Timothy Stewart

    Hi Timonthy,

    Oh! I missed it. I will check this personally and update you soon.

  • 0 in reply to sachingurung

    Hi Timothy,

    I have an answer in regards to this. 

    The problem you're experiencing is a known limitation and will be fixed in version two later this year. Here's a temporary fix, which I actually don't like but it works.

    Create a NON-HTTP business application rule. As the source host, add your country that you want to block. Set the Source Zone to WAN and the hosted address to the WAN interface.

    Then this the part that I'm not fond of - add a dummy or loopback address as the protected server and opt to forward all ports and click save.

    This will then ensure that all requests from the country you want to block are going to a "BlackHole".

  • 0 in reply to BenVerschaeren

    , you win!  That's too bad that this doesn't work out of box however sending the packets of to Neverland is a decent workaround.  Thanks for your help!  I'll keep an eye out for v2.  You were of great help both in the forums and PMs.  You get 2 gold stars! [*][*]

  • 0 in reply to BenVerschaeren

    Do we know if this is fixed in MR2? Had some nasties try to get to my 2012 VPN server, its fairly well protected but would rather stop them even getting the chance to get there. Would rather not put a workaround in and know the rule works. Have set it up but until they try and fail / succeed I have no other way of knowing it is working.

  • 0 in reply to nicholasbooth

    I would also like to know if this has been fixed, because it does not appear to be working after the latest update. My country blocking rule shows zero in and zero out. 

  • 0 in reply to BrettZehr

    It's not although we've introduced a really nice way to do this in version 16 due to be released shortly. Happy to upload a screenshot if it's of interest to you!

  • 0 in reply to BenVerschaeren

    Hi BenVerschaeren,

    I am using SFOS 16.01.1 (upgraded last night) and seeing a lot of Intrusion attacks from the countries I blocked in previous version.

    I got the Firewall rule (Blocked countries) on the Top.

     

    In the Reports -> Network & Threats (Intrusion Attacks 7.75k and growing, Attacks detected and allowed 7.75k).

    This definitely says the rule is not working.

    I found this thread while searching for this issue and I want to know How to create this rule.

    I want to know how to create a dummy loop back address.

     

    Thank you,

    Krishna

  • 0 in reply to AdelaideShores

    I look forward to seeing what everyone else's results are. I tested this on a few different XG's tonight.  I see traffic is hitting the rule, but didn't quite work as I expected (Or maybe it did?).  I put in the Country rule and tested access to a few servers using GeoPeeker.  All of the countries were able to access the website with the Country Block rule up top.  But if I add those Countries to the Blocked Hosts on the Business rule of that server, it works and the Countries on GeoPeeker were not able to access the site.  So thats good, however it seems like by putting the Country rule up top that should have blocked it??  Unsure.

     

    PS.  Why does the traffic show as "Out"?  SHouldn't it be "In"?  Seems backwards?

     

    Thanks