country blocking question

Question

We have been having an issue that is related to country blocking. One company that emails us is routed through germany. Under country blocking I have Germany to block From. I have since created an exception..... 
 
 skip blocking of these countries: Germany 
 for traffic coming from these source networks: IP of Host 
 Using these services: Any 
 
 Even after doing this the emails still get blocked by the firewall from that IP. Only way we can receive from them is to totally turn off blocking for that country. Can someone tell me what Im doing wrong? 
 Also my hardware is a Sophos SG 210 running 9.509-3.

Ol Deda · Answer

Try 
 skip blocking of these countries:Germany for traffic going to these destination networks: 
 WAN (Address) 
 Using these services: smtp

DouglasFoster · Answer

The help file attempts to explain this, but does not fully succeed. 
 
 When the exception target is on the internet, such as your desired mail server, you specify the object and MUST leave the country list EMPTY. UTM does not need to know the country because the IP address already ensures uniqueness. Specifying any countries (or ALL) will produce the unexpected result that you are seeing. This applies whether the exception is FROM or TO the exception target. 
 When the exception object is the UTM or any internal network object, you must specify a country list or ALL. Without a country list, there would be ambiguity. I think an empty list and ALL will produce the same result here, but the documented preference is to use ALL. 
 
 For your example, I think you only need to exempt SMTP (port 25), not port ALL. 
 I think the PORT specification refers to the destination port, whether the exception is the source IP or the destination IP. (Test to verify this.) 
 For web proxy traffic, I have observed some FQDN+IP pairs being assigned to different countries at different times, and I have seen some FQDN-IP pairs with no country assigned. The issue has been confirmed and is in development. I don't actually know if it affects incoming SMTP traffic. But if you are using Country Blocking now, you should be aware that it may have limitations, and continue to monitor your logs.