Thread Info
  • State Suggested Answer
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 696 views
  • Users 0 members are here
Options
Suggested

Can I use geo blocking for a specific NAT rule?

Simon Poke

I'm using a Sophos SG230 with the latest version of UTM 9.

I have a NAT rule routing https traffic hitting a specific external IP to of our servers.  Currently it allows traffic from any IP address through since it could be accessed by users from their home PCs, phones etc.  However I would like to lock it down as much as possible since the server is now being hit with a lot of attempted connections from known compromised IP addresses.

I don't really want to turn on geo blocking in the firewall settings since that blocks all traffic by default and there would be too many exceptions to set up.

Is there a way I can add to the NAT rule that it should only apply to UK addresses rather than using the "any" selector?

Thanks.

Parents
  • 0

    I'm doing something similar in pfsense, but with US based ip's. Specifically for the mail server, I wanted to only allow connections from US based MTA's. This was possible using pfblockerng. An alias was defined for the selected country. Then for the actual DNAT rule, only only traffic originating from that alias is allowed to port 25 (smtp). There's a secondary mx on a third party host that picks up mail primary mx declines. You can add all sorts of lists in various formats.

Reply
  • 0

    I'm doing something similar in pfsense, but with US based ip's. Specifically for the mail server, I wanted to only allow connections from US based MTA's. This was possible using pfblockerng. An alias was defined for the selected country. Then for the actual DNAT rule, only only traffic originating from that alias is allowed to port 25 (smtp). There's a secondary mx on a third party host that picks up mail primary mx declines. You can add all sorts of lists in various formats.

Children
Unfiltered HTML