topic Re: Block countries in General Topics

Block countries

jdprovine — Tue, 14 Feb 2017 20:29:43 GMT

Can you block more that one country in a single security policy?

Re: Block countries

jvalentine — Tue, 14 Feb 2017 20:57:01 GMT

Yes... looks like this:

Re: Block countries

jdprovine — Tue, 14 Feb 2017 21:09:33 GMT

That looks like one over block for the entire firewall can you do the same thing on individual security policies?

Re: Block countries

jvalentine — Tue, 14 Feb 2017 21:27:18 GMT

It's still an individual security policy, applied to the whole firewall. Yes, you could have multiple policies referencing specific countries.

You can also do something like "permit ssh except for china" (not to pick on China). In this case, your source country you would choose the country/countries you want to exempt from this list, and then select the "negate" option. That looks like this:

Re: Block countries

jdprovine — Tue, 14 Feb 2017 21:30:58 GMT

why not pick on China they pick on us 🙂 That is exactly who I wish to block LOL

Re: Block countries

jdprovine — Tue, 14 Feb 2017 21:53:37 GMT

I work at a university and I do not know how practical it would be for us to block whole countries access, since we have many international students. I think we could probably do it on individual security policy level, to block access from certain countries to certain locations or devices or zones

Re: Block countries

pulukas — Tue, 21 Feb 2017 14:26:17 GMT

Some things to bear in mind.

Your inbound block policies will not prevent your students from browsing out to the affected region web sites.

You should be sure to include an inbound allow policy for smtp specifically before your inbound blocks so your student mail will still work (assuming you host the mail servers).

Re: Block countries

OtakarKlier — Tue, 21 Feb 2017 21:23:52 GMT

Hello All,

For the country blocks, we block both ways, inbound and outbound. Sometimes its easier to just list the friendly countries and block the rest rather than blocking a huge list. But either way works. Also with the shortage of IPv4 addresses, we are running into issues where ISP's are buying from other countries and causing issuse for some of our users. Just another weird thing going on.

Cheers!

Re: Block countries

jdprovine — Tue, 21 Feb 2017 21:25:30 GMT

so basically you are using it like a whitelist

Re: Block countries

OtakarKlier — Tue, 21 Feb 2017 21:27:18 GMT

Exactly, a whitelist rather than a blacklist. But it all depends on your situation. I like to follow the less amount of work principle, where the least amount of effort on my part will grant me the resulsts I need.

Re: Block countries

BPry — Tue, 21 Feb 2017 21:33:47 GMT

In my opinion I would only block entire countires on inbound connections and only on certain applications. For example if you host your own exchange enviroment then I would block some countires from sending email in, as long as your business requirements actually allow for this.