topic Re: Block MobileAccess/VPN Client Access from unwanted countries in Firewall and Security Management

Block MobileAccess/VPN Client Access from unwanted countries

freshwater84 — Tue, 07 Apr 2026 19:10:20 GMT

Dear Community,

I wonder, if I can block Mobile Acesss/VPN Client Access in General from unwanted countries, or just allow it from wanted countries.
I'm aware of Geo-Blocking possibilities in rules, but it seems, that VPN access over Mobile Access/VPN-Client is already done in implied rules. Around there I don't want to mess too much around.

We have a quite strong security concept with Certificate+Username/Password for VPN Dial-In, but if I could just whitelist 3-4 countries which we need for VPN access, that would be an extra security of course. Mainly if there should be a 0-Day exploit one day, which is rare but not impossible on Checkpoint...

Re: Block MobileAccess/VPN Client Access from unwanted countries

the_rock — Tue, 07 Apr 2026 19:34:38 GMT

Hey @freshwater84 ,

See if this post I made almost 2 years ago helps? Btw, I did test this later on with few different countries using my personal nordvpn account and worked flawlessly.

https://community.checkpoint.com/t5/SASE-and-Remote-Access/Geo-VPN-blocking/m-p/214040

Re: Block MobileAccess/VPN Client Access from unwanted countries

freshwater84 — Tue, 07 Apr 2026 19:54:02 GMT

Hi Rock,

Thanks for the quick response. Is this parameter also applicable for 3900 ARM series R82.10?
When I check for the parameter on my 3920 R82.10, I get the following output:
# fw ctl get int fw_ignore_before_drop_rules -a
FW:
fw_ignore_before_drop_rules = 0
PPAK 0: Get failed.
Would the regular IPSEC Client (without MobileAccess blade) also being affected, as this parameter just go for 80/443 as far I understood...?

Re: Block MobileAccess/VPN Client Access from unwanted countries

the_rock — Tue, 07 Apr 2026 19:57:40 GMT

Not sure for brand new version, sorry : - (

Might be worth verify with TAC.

Re: Block MobileAccess/VPN Client Access from unwanted countries

Lesley — Wed, 08 Apr 2026 07:43:20 GMT

Just without the -a flag

[Expert@cp0]# fw ctl get int fw_ignore_before_drop_rules
fw_ignore_before_drop_rules = 0
[Expert@cp:0]# fw ctl get int fw_ignore_before_drop_rules -a
FW:
fw_ignore_before_drop_rules = 0
PPAK 0: Get failed.
dmd_mgmt: Get param failed: Unknown parameter fw_ignore_before_drop_rules
dmd_worker: Get param failed: Unknown parameter fw_ignore_before_drop_rules

Re: Block MobileAccess/VPN Client Access from unwanted countries

freshwater84 — Wed, 08 Apr 2026 07:50:03 GMT

Hi Lesley,
Do you know if that is supported on R82.10 on SG3900 series?

And how do I get it permanently into Kernl on R82.10?

Re: Block MobileAccess/VPN Client Access from unwanted countries

Lesley — Wed, 08 Apr 2026 08:00:56 GMT

To make it reboot proof follow please:

https://support.checkpoint.com/results/sk/sk26202

More details regarding this parameter and support:

https://support.checkpoint.com/results/sk/sk105740

It does not show R82.10 but R82, but i cannot see why it should not work. You can just follow the steps.