This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF Rule configuration to only allow access from North America

Hi All,

I have a web server running behind a WAF rule. I cannot find a way block traffic from outside North America inbound. I used to run these behind a DNAT and I could specify this, but cannot in WAF (unless I am missing something).

Thanks in advance.

Stu

This thread was automatically locked due to age.

Top Replies

Peter-Paul Gras over 2 years ago in reply to Stuart Hamilton1 +2 verified

Goto SYSTEM > Hosts and services > Country group Add a new Country Group, add all the countries except for the North America' s Use this country group in your DNAT rule

0 Peter-Paul Gras over 2 years ago

Please take a look over here: https://community.sophos.com/sophos-xg-firewall/f/discussions/127424/sophos-waf-understand

SFVH (SFOS 20.0.0 GA-Build222) - Last (re)boot on November 6th 2023

Asus H410i-plus - Pentium 6605 Gold - 250GB M.2 PCIe NVMe SSD - 8GB - 3 ports

[If any of my posts are helpful to you please use the 'Verify Answer' link]
Cancel
Vote Up 0 Vote Down

Cancel
0 Stuart Hamilton1 over 2 years ago in reply to Peter-Paul Gras

Thanks Peter, so how does the blackhole DNAT interact with the WAF rules? In the example in the other link we are blocking ALL external traffic, but I want to allow a country group to these web servers. In the external source networks and devices section do I have to just add all country codes minus the one I want to allow??
Cancel
Vote Up 0 Vote Down

Cancel
0 Peter-Paul Gras over 2 years ago in reply to Stuart Hamilton1

Ok, afaik you can not apply a GEO IP block to only a specific WAF rule. It applies to all traffic...

SFVH (SFOS 20.0.0 GA-Build222) - Last (re)boot on November 6th 2023

Asus H410i-plus - Pentium 6605 Gold - 250GB M.2 PCIe NVMe SSD - 8GB - 3 ports

[If any of my posts are helpful to you please use the 'Verify Answer' link]
Cancel
Vote Up 0 Vote Down

Cancel
0 Stuart Hamilton1 over 2 years ago in reply to Peter-Paul Gras

I am actually OK with this. So on the blackhole DNAT, do I add source as everything except my country code?
Cancel
Vote Up 0 Vote Down

Cancel
+1 Peter-Paul Gras over 2 years ago in reply to Stuart Hamilton1

Goto SYSTEM > Hosts and services > Country group

Add a new Country Group, add all the countries except for the North America' s

Use this country group in your DNAT rule

SFVH (SFOS 20.0.0 GA-Build222) - Last (re)boot on November 6th 2023

Asus H410i-plus - Pentium 6605 Gold - 250GB M.2 PCIe NVMe SSD - 8GB - 3 ports

[If any of my posts are helpful to you please use the 'Verify Answer' link]
Cancel
Vote Up +2 Vote Down

Cancel
0 Regex over 2 years ago in reply to Stuart Hamilton1

What is the purpose of blackhomeNAT and how to set it up?

Thx

__________SETUP___________

HP Small Form Factor: i5 4Cores, 8Gb of RAM.
Intel Network Card 5x Eth
SSD: 256Gb
Cancel
Vote Up 0 Vote Down

Cancel
0 Peter-Paul Gras over 2 years ago in reply to Regex

support.sophos.com/.../KB-000038943

SFVH (SFOS 20.0.0 GA-Build222) - Last (re)boot on November 6th 2023

Asus H410i-plus - Pentium 6605 Gold - 250GB M.2 PCIe NVMe SSD - 8GB - 3 ports

[If any of my posts are helpful to you please use the 'Verify Answer' link]
Cancel
Vote Up 0 Vote Down

Cancel