Netgate SG-1000 microFirewall

Author Topic: Best way to geo-block on VPN ports  (Read 122 times)

0 Members and 1 Guest are viewing this topic.

Offline davidology

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Best way to geo-block on VPN ports
« on: December 17, 2017, 10:18:02 pm »
I'm using the GeoIP function of PFBNG, but wondering if I'm doing it in the most efficient way.

I noticed a number of rejections hitting my VPN ports. I thought it might be prudent to restrict access to IP addresses to where I may be. As I'm not planning to leave the country in the next 6-months, that meant restricting to US-based IPs.

I setup a rule to drop any connection attempts from an inversion of the North American IP addresses. This seems to work, but I wanted to make sure I'm not creating any unnecessary overheard in either memory or CPU time.

Is this way a good way to go about it?

Thanks for any input/advice!

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2601
  • Karma: +810/-5
    • View Profile
    • Click for Support
Re: Best way to geo-block on VPN ports
« Reply #1 on: December 18, 2017, 09:52:39 pm »
There are many ways to do that... But i would recommend to create a Permit Inbound rules instead. This way your not going to fill the logs will all of the IPs that were blocked hitting that rule... So less noise, means you can review the logs for real events that need attention :)

Its always better to try to limit down the allowed IPs to as small of a range as possible... There are still a lot of IPs in North America... But its still better than leaving it wide open...
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |