Countryblock Rule does not match

Question

Hello, 
 
 I created a Countryblock Rule as described here ( https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/CreateFirewallSecurityRule.html ) but this rule does not match.

My published Webserver must not available outside my Country (one in Europe). 
 On my Deviceaccess / WAN Zone there ist nothing enabled and there is no ACL. 
 
 In my Webserver Log I see many acces from USA, China and so on. 
 Why? 
 How can I fix it? 
 
 sincerly 
 Guenter

LuCar Toni · Answer

Thats not my point. 
 WAF is a priority Item within the firewall rule set. It will grap all traffic, before even the firewall will be applied. Its like NAT. 
 Think about WAF as a NAT+Firewall Rule. As it is a NAT Rule (Business Application rule in v17.5), it will grap the traffic and allow it automatically. As this NAT rule is builtin, it can only excluded by a own NAT rule. 
 The firewall rule at this point will never hit in any manner, as the NAT rule of WAF already marked this traffic to be considered. And the NAT Rule will fetch this with its own NAT Rule. 
 Generally speaking its not a issue, as you can simply perform the same task by a NAT Rule. Its just another screen. 
 PS: Once again, Country Blocking is simply a low level security feature. By no means, it&acute;s secure to perform country blocking and rely on it. Its way to easy to simply use VPNs or hosted servers. There are way to many IPs not categorized today by any country (flexible IPs). Attackers simply bypass such country blocking rules. Scanner like shodan simply shows, if country blocking is in place and tell you, from which country you have to attack.

FormerMember · Answer

Hi Guenter , 
 As LuCar Toni said, the service used within WAF/DNAT/ACL is called local service, and to block the external traffic from specific countries to these services, you'd have to create a black hole DNAT rule. 
 Create a black hole DNAT rule as per the following KBA and add the required countries in the source network: 
 
 Sophos XG: Creating a blackhole DNAT . 
 
 Reference Community thread: GeoIP . 
 Thanks,

Countryblock Rule does not match

Top Replies