Intrusion prevention warning

Hi Gian,

The Firwall Framework works like this.

*incoming Packets*

1. RAW packet processing

2. Contract

3. DNAT

*Routing*

*Forward*

4. Packet Filter

5. IPS

Since the Packet Filter is applied before the IPS kicks in there needs to be something wrong with your Rule if the rule doesnt Block / drop it.

Please show us the Screenshot where we can see the IP and the Port the IP uses. Then post a screenshot of your Top firewall rules.

Also post a screenshot of your NAT rules.

Regards

Jason

Here the screenshot
below you can see top firewall rules and also ip addresses unwanted

DNAT rules

Thanks Gian Luca

Hey Gian,

and the foreign IP wants to access your Server via Port 80?

-Jason

HI,

Yes the foreign IP looking for...

Gian Luca

Hi,

You might want to test a black hole Nat for the IP.

Create a rule (maybe IP Range in case you get more in the future).

New Target:

Source: the IPs that are getting through

Service: HTTP

Destination: should be to an IPv4 address in 240.0.0.0/4 or to one in 100::/64 for IPv6.

Position that rule above your others so that i gets processed first, in theory the IP should be nated into the black hole then.

Ciao Gian Luca and welcome to the UTM Community!

Jason has you headed in the right direction.  Check out #2 in Rulz to understand better why your firewall rules are being ignored.

Cheers - Bob

Hi,

the application of the DNAT blackhole rule as you suggested works fine.

Thank you very much