This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocking all traffic from IP address

Hi All,

I'm running UTM 9.312-8.  Does anyone know of an easy way to drop or block all traffic from an external IP address?  I have added a firewall rule to drop all traffic from a number of IPs but the problem is that the auto firewall rules are processed before the manual rules, so this doesn't take effect for a number of DNATs.  I was thinking I could create a DNAT with an auto rule for all traffic from those IPS, for any service, put this in top position, and then direct to a dummy address?  If so can someone please suggest what I could/should be using for the Action?  Or any other ideas you may have to easily accomplish this would be great.  

Many thanks for your help!


This thread was automatically locked due to age.
Parents
  • Hi, and welcome to the User BB!

    Like Dmitri said. [;)]  Be sure to put the blackhole DNAT ahead of the DNAT that's now accepting the traffic.  To get a better idea of what's happening, check out #2 in Rulz.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • Hi, and welcome to the User BB!

    Like Dmitri said. [;)]  Be sure to put the blackhole DNAT ahead of the DNAT that's now accepting the traffic.  To get a better idea of what's happening, check out #2 in Rulz.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data