asked on

sonicwall

We have a Sonicwall 4060. We get a lot of threats from outside the US, yet we don't do any business outside the US.

Is it possible to tell the Sonicwall to simply DENY ALL REQUESTS/ALL TRAFFIC from IP addresses with an origination outside the US?

thanks

Adrian Cantrill

It seems not to be possible and even if it were i would be VERY much advising any clients of mine against it, you can never be 100% sure of the exact location of IP addresses (subnetting, especially for the larger IP allocations). At best it would need some form of RIPE lookup on a per packet basis which would be very intensive for a heavy traffic site. Aside from the potential for error and thus blocking wanted traffic the admin overhead would be intense.

I've had a quick look on some tech sheets incase im missing any new developments and from what i can see it isnt something that you can do on that device.

IT-Monkey-Dave

What woolnoir said. You would be creating a LOT of headaches if you tried to do this.
The firewall is blocking all uninvited traffic by default. Are you trying to also block connections to "foreign" IPs even if they originate from requests from your network (i.e. your user clicks on a .uk url)?

paulterack2

ASKER

Yes. We have ZERO need for anything outside the US at this time. I appreciate your comments. It's really just something I was thinking about, wondering if possible because I just see so many intrusion attempts, all originating outside the US.

ASKER CERTIFIED SOLUTION

Adrian Cantrill

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Adrian Cantrill

It would be nice if there were a quick way to do it, i dont imagine RIPE would be too pleased either with the multiple order of magnitude increase on the number of IP queries they get... i'd see some evil humour in that one.

SOLUTION

IT-Monkey-Dave

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

papaschlumpf

there is a feature called Geo-IP Filtering. ( https://www.fuzeqna.com/sonicwallkb/consumer/kbdetail.asp?kbid=8963&formaction=catalert ) .
its possible with the new firmware 5.8.1.x ( for example the tz 210 or nsa 240, nsa 2400 ...) has it . Unfortunatly not the pro 4060.