Inbound Blocking

As with UTM 9, all traffic is dropped by default. There is no need to add a "bucket" drop rule, as no traffic of any kind is allowed until a rule is created to allow it.

I know that blocking is enabled by default but there is a need to block certain things.

I have WAF configured and I know I can deny access there to certain sources but I noticed from the WAF logs that there are attacks happening against the sites I do have configured. I would still like the ability to block at the firewall level and not at the WAF level.

I have included some logs below as an example. Call it paranoia but why allow someone access to potentially try something. I'm not sure since I haven't really investigated the stuff below but it is some sort of spoofing happening.

2015-12-16 23:33:50
-
208.52.161.177
/phpmyadmin2/scripts/setup.php
-
-
301
47
408
17071
0

2015-12-16 23:08:59
51.254.206.142
188.68.224.62
/httptest.php
-
-

Hi there,

in UTM 9 there is an easy way to do this task. Just create a dnat rule with a destination to a fake ip. Try it with XG.

Regards
mod

Hi there,

in UTM 9 there is an easy way to do this task. Just create a dnat rule with a destination to a fake ip. Try it with XG.

Regards
mod