Technical Tip: Restricting SSL VPN connectivity from certain countries using firewall geography addresses

[ppatel]

Description

The article describes how to restrict SSL VPN connectivity from certain countries.

By default, SSL VPN is accessible to all public IP addresses from the Internet.

Solution

From CLI.

1. Configure firewall address with the geography type.
   

config firewall address
    edit "restriction_poland"
        set type geography
        set country "PL"  <- Only allows connections from Poland.
    next
end

2. Configure the firewall address group.

config firewall addrgrp
    edit "Geo_restriction_ssl_vpn"
          set member "restriction_poland"
    next
end

3. Configure the firewall address group as the source-address under SSL VPN settings.

config vpn ssl settings
    set servercert "Fortinet_Factory"
    set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
    set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
    set port 444
    set source-interface "wan1"
    set source-address "Geo_restriction_ssl_vpn"
end

From the GUI.

1. Go to Policy & Objects -> Addresses, select 'Create new', select 'Geography' as the address Type, and select the country to allow.
   
   

If there is more than one country to allow, make a group on the firewall. 

2. After creating the country on the addresses, the same must be mapped on the firewall SSL VPN settings to restrict access.
   
   Go to VPN -> SSL-VPN Settings. Under 'Restrict Access', select 'Limit access to specific hosts' and add the address object created in step 1 to allow access to the VPN.

This will ensure that only the selected Country/Region IP addresses will be able to connect to the SSL VPN.

Note:
If there are SSL VPN authentication rules that have source-address defined as 'all', the globally configured source-address will not work.

Make sure to remove source-address from the authentication rules, or configure appropriate source-addresses from allowed countries for each authentication rule.

Furthermore, it is possible to include a public IP address or range of IP addresses in order to allow access to IP addresses that are not included or categorized in the selected geographical area. 

In the preceding example, users from Poland are permitted to connect to this SSL VPN. However, if it is also necessary to add a few individual IP addresses/ranges from an undefined Country/Region, the address objects can be included under SSL VPN settings as shown below.

If there are still hits from different IPs from different countries that are not allowed, refer to the information and steps below:

1. It is possible to see other IPs trying to log into the VPN event logs. (Other than the US that is allowed).
2. It is possible to check the location through the geo IP command. Be sure to update the geo IP database on FortiGate first with the following command:

execute update-geo-ip

To find the location of the IP:

diagnose firewall ipgeo ip2country x.x.x.x <- The IP.

Alternatively, check with Instant IP Address Lookup (whatismyipaddress.com).

3. It is possible to create an authentication rule if one is not present. If one is present, add the source interface and source address under it:
   

config vpn ssl settings

    config authentication-rule
        edit 1
            set source-interface "wan1" <----- Interface specified in SSL VPN.
            set source-address "Allow US IPs Only" <----- Just use the country desired to allow.
            set groups "SSLVPN_users" <----- this is the group in the policy of SSL VPN.
            set portal "full-access"

4. After these changes, it will not be possible to see any other attempt from outside the US in the VPN events logs.

Another method would be to use local-in-policy to block any attempts to connect to SSL VPN.

First, create a policy that allows traffic from a specific country:

config firewall local-in-policy
    edit 0
        set intf "wan1"
        set srcaddr "Allow US IPs Only"
        set dstaddr "all"
        set service "SSLVPN-Port"   <- port that is used for SSL VPN connections.
        set schedule "always"
        set action accept

    next
end

Second deny access from all other countries:

config firewall local-in-policy
    edit 1
        set intf "wan1"
        set srcaddr all
        set dstaddr "all"
        set service "SSLVPN-Port"   <-- port that is used for SSL VPN connections.
        set schedule "always"
    next
end

After this, it will show newly created policies via GUI.

Note that it can be necessary to activate local-in-policy in GUI in order to view the current settings:

System -> Feature Visibility -> Check Local-In-Policy and select Apply.

For SSL VPN, VPN configuration, and port used in this article, more information is available via this link:
SSL VPN best practices | FortiGate / FortiOS 7.4.1 | Fortinet Document Library