country blocking - block all then add exceptions??

Question

New to sophos UTM. Is it do-able and would it make sense/work to block "from" all countries and have exception allowing from my own country for IPSec VPN and Webadmin services (for Any IP), which is the only traffic I would like to accept? 
 I'm assuming blocking traffic "from" a country is about blocking calls initiated by that country, i.e. it wouldn't block the *response* to a call initiated from my allowed country to the blocked country. Is that true? 
 Unit is remote right now and I fear testing my theories could result in my losing access to the remote device and the people at that site losing all internet access...

BAlfson · Accepted Answer

You're right, Jean, Country Blocking does work as you understand. That said, I wouldn't use Country Blocking for this. 
 I would only use specific IPs or subnets instead of the "Any" object in WebAdmin Settings: 
 
 As for IPsec remote access, I would use Authentication by X509 instead of a preshared key. 
 In both cases, you could add extra security with One-Time Passwords. 
 Cheers - Bob

dirkkotte · Answer

As said by bob, the country blocking rules work in this way. i mean this is the right approach to prevent access from all over the world. Use "from" as option. In order not to prevent my own VPN and web access, I exclude my own country completely. As Bob said, "any" should not be the source in the WebAdmin. Better use your own IP or a DynDNS host. If you receive mail, don't forget to build an exception.

country blocking - block all then add exceptions??

Top Replies