topic Re: Block VPN Traffic by Country in Firewall and Security Management

Block VPN Traffic by Country

PhoneBoy — Fri, 21 Apr 2023 15:35:23 GMT

VPN traffic (Site to Site or Remote Access) is currently accepted by Implied Rules, meaning you cannot use Access Policy or legacy GeoProtection to block VPN access from specific countries.

@Aleksandr_Nosit pointed out to me that DOS Rate Limiting rules can be set by country, which will block all matched traffic (including VPN) before implied rules.
Here are a couple examples (see sk112454 for other possibilities)

Option 1: allow access from specific countries, block the rest

“X.X.X.X” – is gateway external interface IP address:

Bypass rules:

fwaccel dos rate add -a b source cc:EE
fwaccel dos rate add -a b source cc:LV
fwaccel dos rate add -a b source cc:FI
fwaccel dos rate add -a b source cc:SE
fwaccel dos rate add -a b source cc:DK

Block “rest of the world” rule :

fwaccel dos rate add -a d -l a service any source any destination cidr:X.X.X.X/32 pkt-rate 0

Option 2: block specific countries

This will block China while allowing other countries:

fwaccel dos rate add -a d -l a service any source cc:CC destination cidr:X.X.X.X/32 pkt-rate 0

Re: Block VPN Traffic by Country

Machine_Head — Wed, 01 Mar 2023 15:28:50 GMT

Thanks!

Useful as some customers complain about implied rules

Re: Block VPN Traffic by Country

PhoneBoy — Wed, 01 Mar 2023 18:42:42 GMT

I can see this method being useful for "overriding" certain implied rules, particularly if the dos rules are very targeted.

Re: Block VPN Traffic by Country

the_rock — Wed, 01 Mar 2023 19:02:22 GMT

Thanks phoneboy, thats super useful info, for sure.

Andy

Re: Block VPN Traffic by Country

CheckPointerXL — Fri, 21 Apr 2023 09:47:55 GMT

Hello PhoneBoy,

about the statement:

Block “rest of the world” rule :

fwaccel dos rate add -a d -l a service any source destination cidr:X.X.X.X./32 pkt-rate 0

Did you miss "any" after "source" ? or maybe you can avoid to specify "source" word for "any" because of it is default

another question, did this configuration survives to JHF/major upgrade installations ?

Re: Block VPN Traffic by Country

PhoneBoy — Fri, 21 Apr 2023 15:34:11 GMT

You are correct, I was missing an "any" there and have fixed it in the original post.
If I remember correctly, fwaccel dos rules are persistent across reboots/upgrades.

Re: Block VPN Traffic by Country

Chris_Atkinson — Mon, 31 Jul 2023 13:15:20 GMT

sk180527 & sk126172 will be helpful for anyone attempting similar using VSX.

Re: Block VPN Traffic by Country

the_rock — Fri, 05 Jan 2024 17:45:12 GMT

@PhoneBoy So sorry to reply to this almost a year later, but just need to confirm something. Is there any limitation for this when you create VMSS CP fw on Azure? My colleague and I tested it with public IP assisnged and we blocked CA (country code for Canada) from your 2nd example to external IP of the fw, but we could still create and connect to VPN site.

Thanks in advance.

Best,

Andy

Re: Block VPN Traffic by Country

PhoneBoy — Fri, 05 Jan 2024 20:53:02 GMT

In Public Cloud, it's entirely possible we're not seeing the real source IP (depending on the exact configuration).
You should confirm precisely what IP the gateway is seeing with tcpdump or similar.

Re: Block VPN Traffic by Country

the_rock — Sat, 06 Jan 2024 02:24:00 GMT

I really have gut feeling its because even though ifconfig shows public IP, BUT, when I look at fw topology in smart console object, that IP is NOT listed there...I will talk to one of my colleagues next week who is way better with Azure than myself, but logically, thats what stands out to me.

Andy

eth0 Link encap:Ethernet HWaddr 00:0D:3A:F4:98:C4
inet addr:10.2.0.4 Bcast:0.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::20d:3aff:fef4:98c4/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:604471 errors:0 dropped:0 overruns:0 frame:0
TX packets:598227 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:466812315 (445.1 MiB) TX bytes:142959965 (136.3 MiB)

eth0:1 Link encap:Ethernet HWaddr 00:0D:3A:F4:98:C4
inet addr:52.229.98.249 Bcast:52.229.98.249 Mask:255.255.255.255
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

eth1 Link encap:Ethernet HWaddr 00:0D:3A:F4:9E:31
inet addr:10.2.1.4 Bcast:0.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::20d:3aff:fef4:9e31/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:2424 (2.3 KiB)

Re: Block VPN Traffic by Country

VikingsFan — Thu, 27 Mar 2025 11:51:16 GMT

Wouldn't there be an Option 3, which we're doing currently: Disable the Implied Rule and manually build out your accept rules/block rules? Might not be preferred by most but it gives us more granular control and able to do everything within the access layer instead of CLI.

Re: Block VPN Traffic by Country

the_rock — Thu, 27 Mar 2025 12:02:48 GMT

See if this post I made last year helps. I definitely validated it works 100%, but you know how it goes with Azure subscription, even when devices are powered off, they still charge you 🙂

Andy

https://community.checkpoint.com/t5/Remote-Access-VPN/Geo-VPN-blocking/m-p/214040#M10593

Re: Block VPN Traffic by Country

the_rock — Thu, 27 Mar 2025 12:07:42 GMT

FWIW, just my PERSONAL opinion, I would NOT be disabling implied rules. I had seen people do this before and more often than not, down the road, it can lead to more issues.

Thats just my experience...

Andy

Re: Block VPN Traffic by Country

VikingsFan — Fri, 28 Mar 2025 11:37:47 GMT

Agree. We did have some bumps from disabling a handful of the implied rules but now have the ruleset pretty solid with no issues (to my knowledge). 🙂 Could always manually build out the rules from this list too, which is what I used for checking some of mine: https://support.checkpoint.com/results/sk/sk119497

The change to the Geo Blocking and removing it from Smart Console and not working with access rules was one of the driving factors to look at removing implied rules. Can't remember exactly but even with setting that configuration you referenced we were seeing countries getting through for VPN activity. I didn't disable ALL the rules but focused on the remote access ones and also some of the SMB ones which we don't service on this gateway.

The ones we disabled are attached if interested.

Re: Block VPN Traffic by Country

the_rock — Fri, 28 Mar 2025 11:47:50 GMT

Speaking of geo blocking, did post I made last year that I posted in previous response help? Not sure if makes sense, but definitely worked when I tested it.

Andy

Re: Block VPN Traffic by Country

VikingsFan — Fri, 28 Mar 2025 12:07:25 GMT

It makes sense and unfortunately I did not find that during my testing last year when implementing the cluster. Looked at my notes and I had found this SK: https://support.checkpoint.com/results/sk/sk180808 but don't believe it worked as expected which is why I started unchecking implied rules. Things are stable now and don't think we'll revert anything but would have been great if I had seen your post.

Re: Block VPN Traffic by Country

CheckPointerXL — Fri, 28 Mar 2025 12:11:19 GMT

i was able to control access by country into access policy after following https://support.checkpoint.com/results/sk/sk105740

Re: Block VPN Traffic by Country

the_rock — Fri, 28 Mar 2025 12:13:00 GMT

Hey, no worries, all good, as long as things are stable.

Andy

Re: Block VPN Traffic by Country

chethan_m — Tue, 03 Jun 2025 05:02:41 GMT

Much needed.

Thank you!

Re: Block VPN Traffic by Country

Timothy_Hall — Mon, 15 Sep 2025 21:25:16 GMT

The country code for China is CN, not CC in your Option 2 command. The inhabitants of the Coco/Keeling Islands took offense. 🙂