Firewalls — Blocking, Whitelisting & How It All Works

🌐 Networking

🔥 Firewall Rules & Policies — How They Actually Work

Rules are processed TOP → BOTTOM. First match WINS. Order is everything.

ANATOMY OF A FIREWALL RULE — Every Field Explained

ACTION

ALLOW / DENY / DROP

What to do
when matched

SOURCE

IP / RANGE / ANY

Where traffic
comes FROM

DEST

IP / SUBNET / ANY

Where traffic
is going TO

PORT

80 / 443 / 22 / ANY

Which port
or service

PROTO

TCP / UDP / ICMP

Network
protocol

LOG

YES / NO

Record this
in audit log

HOW RULES ARE PROCESSED — Top to Bottom, First Match Wins

1 ALLOW TCP 192.168.1.10/32 → server :443 Sysadmin IP → HTTPS allowed

2 ALLOW TCP 0.0.0.0/0 → server :80,443 Public web traffic allowed

3 ALLOW TCP 10.0.0.0/8 → server :22 Internal network SSH only

4 DENY TCP 0.0.0.0/0 → server :22 Block all other SSH ← MUST be AFTER rule 3!

5 DENY ALL 0.0.0.0/0 → server :* Implicit deny all — everything else blocked

⚠️ If rule 3 and 4 were swapped — rule 4 (deny all SSH) hits FIRST → internal admins get locked out too!

✅ Stateful Firewall (AWS SG, Windows Firewall)

Tracks connection state.
You allow inbound → outbound reply is automatically allowed.
You only write rules for the DIRECTION you initiate.
Allow TCP 0.0.0.0/0 → :443
→ Browser gets response automatically. No outbound rule needed.

⚠️ Stateless Firewall (OCI Security Lists, ACLs)

No connection tracking.
You MUST write rules for BOTH directions explicitly.
Allow inbound 443 → also need outbound ephemeral ports.
Allow IN: TCP any → :443
Allow OUT: TCP :1024-65535 → any

$_

Firewall #1 — iptables / nftables (Linux Built-in)

Most common in DevOps — every Linux server, Docker, Kubernetes uses this under the hood

📋 iptables Chains — Three Checkpoints for Every Packet

PREROUTING

Before routing decision
NAT destination IP
Port forwarding

→

INPUT ⭐

Traffic TO this server
Most rules go here
Inbound connections

→

FORWARD

Traffic THROUGH server
Routers use this
NAT gateway rules

→

OUTPUT

Traffic FROM this server
Outbound connections
Egress filtering

→

POSTROUTING

After routing decision
Masquerade/SNAT
NAT source IP

Essential iptables Commands

# View all rules with line numbers
sudo iptables -L -n -v --line-numbers

# Allow established connections (CRITICAL - put first!)
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from your IP only
sudo iptables -A INPUT -p tcp --dport 22 -s 192.168.1.10 -j ACCEPT

# Allow HTTP and HTTPS from anywhere
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow loopback (localhost traffic)
sudo iptables -A INPUT -i lo -j ACCEPT

# DENY everything else (add LAST!)
sudo iptables -A INPUT -j DROP

Rate Limiting + Block IPs + Save Rules

# Rate limit SSH (max 3 attempts/min) - brute force protection
sudo iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min --limit-burst 3 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROP

# Block a specific IP (attacker)
sudo iptables -A INPUT -s 203.0.113.42 -j DROP

# Block entire country/range
sudo iptables -A INPUT -s 185.220.0.0/16 -j DROP

# Delete a specific rule by line number
sudo iptables -D INPUT 5

# SAVE rules (survive reboot)
sudo apt install iptables-persistent
sudo netfilter-persistent save

# Check saved rules
cat /etc/iptables/rules.v4

Port Forwarding + NAT (Gateway use case)

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Forward port 80 on this server to internal server 10.0.0.5:8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.5:8080

# Masquerade (NAT) for packets going out
sudo iptables -t nat -A POSTROUTING -j MASQUERADE

# Allow forwarding between interfaces
sudo iptables -A FORWARD -i eth0 -j ACCEPT

UFW — Friendly Wrapper for iptables (Ubuntu)

# UFW = Uncomplicated Firewall (easier syntax)
sudo ufw enable
sudo ufw status verbose

# Allow specific services
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow from 192.168.1.0/24 to any port 22

# Deny and block
sudo ufw deny 23/tcp # deny telnet
sudo ufw deny from 10.0.0.5 # block IP

# Delete a rule
sudo ufw delete allow 80/tcp

# Limit SSH (brute-force protection)
sudo ufw limit ssh

🌍 Real World Use — Production Web Server iptables Policy

Complete hardened server setup (run top to bottom)

# 1. Flush existing rules (fresh start)
sudo iptables -F

# 2. Default policy — DROP everything
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# 3. Allow established/related (MUST be first!)
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# 4. Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# 5. Allow SSH from office IP only
sudo iptables -A INPUT -p tcp --dport 22 -s YOUR_OFFICE_IP -j ACCEPT

# 6. Allow web traffic
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# 7. Allow ICMP ping (optional)
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# 8. Log denied packets before dropping
sudo iptables -A INPUT -j LOG --log-prefix "IPTABLES_DROP: " --log-level 4

# 9. Save
sudo netfilter-persistent save

🦈 pf

Firewall #2 — pfSense / OPNsense (Open Source Enterprise)

Full-featured network firewall used in SMBs, home labs, data centers — free and enterprise-grade

📡 pfSense Interface Zones — WAN / LAN / DMZ

🌐 WAN (Internet)

Untrusted zone. Your ISP / upstream. Default policy: block all inbound. Only allow what you explicitly open.

→

🏠 LAN (Internal)

Trusted zone. Your office / home network. Default policy: allow all outbound. Block WAN→LAN by default.

↔

🖥️ DMZ (Servers)

Semi-trusted zone. Web/mail servers. WAN can reach DMZ on specific ports. DMZ CANNOT reach LAN directly.

HOW TO SET A RULE IN pfSense — Step by Step

GUI Path:

 Firewall → Rules

 → Select interface (LAN/WAN/DMZ)

 → Click ✚ Add Rule

 → Fill in fields:

   Action: Pass / Block / Reject

   Interface: LAN

   Protocol: TCP

   Source: LAN subnet

   Destination: any

   Dest port: 443

   Description: Allow HTTPS

 → Save → Apply Changes

Example Ruleset — Office Network:

✅ LAN → WAN :80,443 PASS (web browsing)

✅ LAN → WAN :53 PASS (DNS)

✅ LAN → WAN :587 PASS (email send)

🔒 LAN → WAN :22 BLOCK (no SSH out)

🔒 LAN → WAN :* BLOCK (implicit deny)

✅ WAN → DMZ :80,443 PASS

❌ WAN → LAN :* BLOCK (all inbound)

❌ DMZ → LAN :* BLOCK (DMZ isolation)

ALIASES — The pfSense Superpower (Group IPs into Named Objects)

Firewall → Aliases → Add

Name: ADMIN_PCs
Type: Host(s)
Network: 192.168.1.10
Network: 192.168.1.11
→ Now use ADMIN_PCs in rules

Why Aliases matter:

Instead of 10 rules for 10 IPs, write 1 rule using alias. Update alias when IPs change — all rules update automatically. No mistakes, no missed rules.

🛡️ pfSense How It Blocks Real-World Attacks

Port Scan Attack

Snort/Suricata IDS detects scan pattern → auto-adds attacker IP to BlockList alias → all rules using BlockList auto-deny them

Brute Force Login

pfBlockerNG detects 5+ failed logins → temp blocks source IP for 1 hour → logs event with timestamp for audit

Malware C2 Traffic

pfBlockerNG DNSBL blocks known malware domains at DNS level → infected device cannot phone home → kill switch without touching the device

WG

WatchGuard Firebox — Enterprise Firewall Setup

Used in real enterprises — Fireware OS, Policy Manager, policies + rules that block unauthorized access

ENTERPRISE

🏗️ WatchGuard Firebox Architecture — Interfaces & Zones

🌐

External

WAN / Internet
Untrusted
eth0

⟶

🔥

FIREBOX

WatchGuard Engine
Policies processed here
All traffic inspected

⟶

Trusted (LAN)

Office PCs, servers
192.168.1.0/24

Optional (DMZ)

Web/mail servers
10.0.10.0/24

Custom (Guest WiFi)

Isolated visitors
10.0.20.0/24

📋 WatchGuard Policy Setup — Step by Step Procedure

STEP 1 — Access Fireware Web UI

Browser → https://192.168.111.1:8080 (default Firebox IP)
Login: admin / wg (change immediately!)
OR use WatchGuard System Manager (WSM) desktop app for advanced config

STEP 2 — Set Default Policies (Deny Everything First)

Fireware UI → Firewall → Policies
WatchGuard default: Unhandled packets = DENY + LOG
This means: if no policy matches → packet is dropped and logged
✅ This is the correct Zero Trust starting point

STEP 3 — Create a Policy (Add → Policy Template OR Custom)

Policy fields to fill:

 Policy Type: Packet Filter / Proxy

 Name: Allow-HTTPS-Out

 Action: Allow

 From: Trusted (LAN) ← source

 To: External (WAN) ← destination

 Port: HTTPS (443/TCP)

 Schedule: Always

 Logging: Log allowed traffic ✅

 Notification: None / Alert

Policy Types explained:

Packet Filter — fast, L3/L4 only (IP+port)
Proxy Policy — deep inspection, L7 (content aware)
Application Control — block by app (YouTube, Teams)
IPS Policy — signature-based intrusion detection

STEP 4 — Complete Office Policy Ruleset (Ordered Top to Bottom)

#	Policy Name	From	To	Port	Action
1	Allow-Web-Out	Trusted	External	80,443	ALLOW
2	Allow-DNS-Out	Trusted	External	53 UDP	ALLOW
3	Allow-Email-Out	Trusted	External	25,465,587	ALLOW
4	Allow-VPN-Mgmt	External	Firebox	443/4100	ALLOW
5	Allow-Web-In-DMZ	External	DMZ:webserver	80,443	ALLOW
6	Block-DMZ-to-LAN	DMZ	Trusted	Any	DENY+LOG
7	Block-Guest-LAN	Guest WiFi	Trusted	Any	DENY+LOG
∞	Default-Deny-All	Any	Any	Any	DENY+LOG

🛡️ How WatchGuard Blocks Unauthorized Access — Real World Scenarios

🔴 Attack: Port Scan from Internet

Hacker scans 0.0.0.0 → 65535 looking for open ports on your IP

WatchGuard Response:

1. Default-Deny-All hits
2. All closed ports → DROP
3. IPS detects scan pattern
4. Source IP auto-blocked
5. Alert sent to admin email
6. Full log with timestamp

🟡 Attack: Ransomware Trying to Phone Home

Infected PC tries to connect to C2 server on port 443 (looks like HTTPS)

WatchGuard Response:

1. HTTPS Proxy policy intercepts
2. Deep packet inspection checks cert
3. APT Blocker scans payload
4. Reputation Enabled Defense blocks known C2 IPs
5. Connection dropped
6. Admin alerted with source PC hostname

🟣 Attack: Employee Accesses Blocked Site

User tries to visit a gambling or malware-hosting website during work hours

WatchGuard Response:

1. WebBlocker checks URL category
2. Category = Gambling/Malware → BLOCK
3. Browser shows block page with reason
4. User can submit override request
5. Manager receives approval request
6. Log records: user, time, URL, action

🟢 Legitimate: Remote Worker VPN

Employee works from home and connects to office resources

WatchGuard Flow:

1. User opens WatchGuard Mobile VPN
2. Connects to Firebox on port 443
3. MFA challenge sent to phone
4. Auth successful → SSL VPN tunnel
5. Remote PC gets 172.16.0.x IP
6. Policy: VPN → Trusted ALLOW
7. Full access to office network

🔴 Attack: Brute Force SSH on DMZ Server

Bot tries 1000 passwords/second on SSH port 22 of web server

WatchGuard Response:

1. Policy: External → DMZ :22 = DENY (SSH not open!)
2. All attempts dropped at firewall
3. Server never even sees the attempts
4. Source IP logged and blocked
5. Threshold alert: 100+ denies/min
6. Automatic Blocked Sites entry added

🔵 WatchGuard Security Services Stack

Gateway AV — scan files for malware
IPS — block exploit attempts
APT Blocker — sandbox unknown files
WebBlocker — URL/category filtering
Application Control — block by app
DNSWatch — block malicious domains
Reputation — block known bad IPs

📊 Monitoring & Logs in WatchGuard — Where to See Blocked Traffic

Fireware Web UI:

System Status → Traffic Monitor — live denied packets
Firebox System Manager → Log Messages
Dimension → Reports → Blocked Sites
Security Services → Intrusion Prevention → Events

What each log line tells you:

 2024-01-15 14:32:11 Deny

 src=203.0.113.42 dst=10.0.10.5

 proto=TCP sport=54321 dport=22

 policy=Default-Deny-All

 msg="Unhandled external packet"

A firewall is a security guard for network traffic. It reads every packet and decides: allow it through, or drop it? It can block by IP, port, protocol, URL, or even the content of packets.

🍎 REAL-WORLD ANALOGY

Firewall = bouncer at a nightclub.
The bouncer has a rulebook: "no trainers, no caps, over-18 only"
Each person (packet) is checked against the rules.
Matching the wrong rule = denied entry (packet dropped).
No matching rule = also denied (default deny = most secure).

📐 How Firewall Blocks Websites — URL Filtering & Whitelisting Process

How URL/Website Blocking Works — Step by Step

1

Employee types facebook.com in browser

Browser needs to know the IP of facebook.com.
It makes a DNS request: "What is the IP of facebook.com?"

↓

2

DNS request goes through company DNS / proxy

Company network routes all DNS queries through its own DNS server.
The DNS server checks the block list before answering.

↓

3

DNS server finds facebook.com on BLOCK LIST

Rule found: facebook.com → BLOCK (social media category)
Instead of returning the real IP, it returns a "block page IP".

↓

4

Browser receives block page response

Browser connects to the block page IP.
Employee sees: "This website is blocked by company policy."
Alternative: DNS server returns NXDOMAIN (domain does not exist)

↓

5

Traffic never reaches facebook.com

The actual facebook.com servers never receive any connection.
From facebook's perspective, the employee never tried to visit.

Types of Firewall Rules

Block Type	How it works	Example
IP blocking	Block traffic from/to specific IP addresses	Block known hacker IPs: DENY src 185.220.101.0/24
Port blocking	Block specific port numbers	DENY inbound port 23 (Telnet — insecure)
Protocol blocking	Block entire protocols	DENY ICMP (prevents ping — hides server existence)
URL/Domain filtering	Block by domain name (DNS-based)	BLOCK facebook.com, instagram.com, .torrent.
Category blocking	Block entire categories of websites	BLOCK category: social-media, gambling, adult
Application blocking	Block apps even if they change ports	BLOCK BitTorrent app (NGFW inspects traffic signature)
Deep Packet Inspection	Read inside the packet contents	BLOCK packets containing "password=" in plain text

AWS Firewall — Security Groups (Full Explanation)

Security Group Commands

# Security Group is a STATEFUL firewall on each EC2/RDS/ALB

# What STATEFUL means:
# If you allow inbound port 443 from 0.0.0.0/0,
# the RESPONSE traffic is automatically allowed back.
# You do NOT need an outbound rule for port 443.
# This is different from a stateless firewall (like NACL).

# Create Security Group
SG_ID=$(aws ec2 create-security-group \
 --group-name web-server-sg \
 --description "Web server security group" \
 --vpc-id vpc-12345678 \
 --query GroupId --output text)

# ALLOW HTTPS from internet
aws ec2 authorize-security-group-ingress \
 --group-id $SG_ID \
 --protocol tcp --port 443 --cidr 0.0.0.0/0

# ALLOW HTTP redirect from internet
aws ec2 authorize-security-group-ingress \
 --group-id $SG_ID \
 --protocol tcp --port 80 --cidr 0.0.0.0/0

# ALLOW SSH from YOUR IP ONLY (replace with your IP)
aws ec2 authorize-security-group-ingress \
 --group-id $SG_ID \
 --protocol tcp --port 22 --cidr 203.0.113.50/32

# ALLOW app port from ALB Security Group ONLY
aws ec2 authorize-security-group-ingress \
 --group-id $SG_ID \
 --protocol tcp --port 8080 \
 --source-group sg-alb-12345 # only ALB can reach port 8080!

# View current rules
aws ec2 describe-security-groups --group-ids $SG_ID

Whitelisting — How to Allow Blocked Traffic

📋 Whitelisting = explicitly allowing specific traffic that would otherwise be blocked. The opposite is blacklisting (explicitly blocking specific traffic).

Whitelisting in AWS

# Example: your server needs to call a payment gateway API
# but outbound HTTPS is restricted by corporate firewall

# Step 1: Identify exact domain/IP needed
# Payment gateway docs say: use api.stripe.com (54.x.x.x)

# Step 2: Submit IT ticket with business justification
# "Application name: checkout service"
# "Destination: api.stripe.com:443"
# "Protocol: HTTPS"
# "Business reason: process payments for customers"
# "Owner: payments team / John Smith"

# Step 3: IT adds rule to firewall
# AWS NACl (stateless — need BOTH directions):
aws ec2 create-network-acl-entry \
 --network-acl-id acl-12345 \
 --rule-number 100 \
 --protocol tcp \
 --port-range From=443,To=443 \
 --cidr-block 54.187.174.0/24 \
 --rule-action allow \
 --egress # outbound rule

# Also allow return traffic (stateless = need explicit rule):
aws ec2 create-network-acl-entry \
 --network-acl-id acl-12345 \
 --rule-number 200 \
 --protocol tcp \
 --port-range From=1024,To=65535 \
 --cidr-block 54.187.174.0/24 \
 --rule-action allow \
 --ingress # inbound return traffic

# Security Group (stateful — only need one direction):
aws ec2 authorize-security-group-egress \
 --group-id sg-app-12345 \
 --protocol tcp --port 443 --cidr 54.187.174.0/24

HTTPS — How Encryption Protects Your Data

📐 How TLS/HTTPS Works — Securing Connections

TLS ensures no one between you and the server can read your data, even on public WiFi

Common Ports to Know

Port	Protocol	Service	Firewall Rule
22	TCP	SSH — remote server access	Allow from YOUR IP only
80	TCP	HTTP — unencrypted web	Allow from 0.0.0.0/0 (redirect to 443)
443	TCP	HTTPS — encrypted web	Allow from 0.0.0.0/0
3306	TCP	MySQL database	Allow from app-sg ONLY. Never internet.
5432	TCP	PostgreSQL	Allow from app-sg ONLY. Never internet.
6379	TCP	Redis	Allow from app-sg ONLY. Never internet.
27017	TCP	MongoDB	Allow from app-sg ONLY. Never internet.
25	TCP	SMTP email	Allow outbound to email servers
53	UDP/TCP	DNS queries	Allow outbound to 8.8.8.8 and 8.8.4.4
123	UDP	NTP time sync	Allow outbound to 0.0.0.0/0
8080-8090	TCP	App servers (common)	Allow from load balancer SG only
2379-2380	TCP	etcd (Kubernetes)	Internal cluster only

FG

FortiGate — Next-Generation Firewall (NGFW)

Fortinet FortiOS — Used in enterprises worldwide. Full UTM: firewall + VPN + IPS + WAF + SD-WAN in one box

NGFW UTM

🏗️ FortiGate Architecture — Interfaces, VDOMs & Security Fabric

🌐

WAN1 / WAN2

Internet uplinks
ISP1 + ISP2
SD-WAN load balance

→

🛡️

FortiGate

FortiOS 7.x
ASIC-accelerated
All traffic inspected

→

LAN (port2)

192.168.1.0/24 — Trusted

TRUST

DMZ (port3)

10.0.10.0/24 — Servers

DMZ

Guest WiFi (port4)

10.0.20.0/24 — Isolated

UNTRUST

SSL-VPN / IPsec

172.16.0.0/24 — Remote users

VPN

VDOMs (Virtual Domains): FortiGate can split into multiple virtual firewalls — e.g. one VDOM per department/customer. Each VDOM has independent policies, routing, admins. Like VMware for firewalls.

📋 Creating a Firewall Policy — Step by Step in FortiOS GUI

ACCESS FortiGate Web UI

Browser → https://192.168.1.99 (default LAN IP)
Login: admin / (blank password first time — set immediately!)
Dashboard → Policy & Objects → Firewall Policy → Create New

POLICY FIELDS — What Every Field Means

 Name: Allow-LAN-to-Internet

 Incoming Interface: port2 (LAN)

 Outgoing Interface: WAN1

 Source: LAN_subnet [address object]

 Destination: all

 Service: HTTPS, HTTP, DNS

 Action: ACCEPT

 NAT: Enable (outbound SNAT)

 Log: All Sessions / Security Events

Security Profiles to attach:
AntiVirus → scan all traffic
Web Filter → block categories
Application Control → block apps
IPS → block exploit attempts
SSL Inspection → decrypt HTTPS
DNS Filter → block bad domains

⚠️ Without SSL Inspection, HTTPS traffic is blind — malware hides in encrypted traffic!

ADDRESS OBJECTS — Name Your IPs (Use These in Policies, Not Raw IPs)

Policy & Objects → Addresses → Create New:

 Name: Web_Server

 Type: Subnet

 IP/Mask: 10.0.10.5/32

 Interface: port3 (DMZ)

 Comment: Main web server

 Name: Admin_PCs

 Type: IP Range

 IP Range: 192.168.1.10-192.168.1.20

Why use address objects?

• Server IP changes? Update ONE object — all policies update automatically
• Readable policies — "Allow Admin_PCs to Web_Server" vs "Allow 192.168.1.10-20 to 10.0.10.5"
• Group objects: create "All_Servers" containing Web_Server + DB_Server + Mail_Server

🗂️ Complete FortiGate Policy Table — Production Office Setup

#	Name	From → To	Service	Action	Security Profiles
1	LAN-to-Internet	LAN → WAN1	HTTP,HTTPS,DNS	ACCEPT	AV + WebFilter + AppCtrl + IPS + SSL
2	LAN-to-Email	LAN → WAN1	SMTP,SMTPS,IMAP	ACCEPT	AV + AntiSpam + SSL
3	Admin-to-DMZ-SSH	Admin_PCs → DMZ	SSH (22)	ACCEPT	IPS only
4	WAN-to-WebServer	WAN → Web_Server	HTTPS (443)	ACCEPT	WAF + IPS + AV + SSL
5	VPN-to-LAN	SSL-VPN → LAN	ALL	ACCEPT	AV + IPS
6	Guest-Internet-Only	Guest → WAN1	HTTP,HTTPS	ACCEPT	WebFilter + AppCtrl
7	Block-Guest-LAN	Guest → LAN/DMZ	ALL	DENY	Log only
8	Block-DMZ-to-LAN	DMZ → LAN	ALL	DENY	Log + Alert
∞	Implicit Deny All	ANY → ANY	ALL	DENY+LOG	Always active — cannot delete

💻 FortiOS CLI — Essential Commands

View & diagnose policies

# List all firewall policies
get firewall policy

# Show specific policy detail
show firewall policy 3

# Watch live traffic hits per policy
diagnose firewall iprope show 100004

# Check if traffic matches a policy
diagnose firewall iprope lookup 192.168.1.10 10.0.10.5 tcp 12345 443

# Show active sessions
diagnose sys session list
diagnose sys session filter src 10.0.0.5

Create policy via CLI

config firewall policy
 edit 0
 set name "Block-Bad-IP"
 set srcintf "port2"
 set dstintf "wan1"
 set srcaddr "all"
 set dstaddr "Blocked_IPs"
 set action deny
 set schedule "always"
 set service "ALL"
 set logtraffic all
 next
end

# Block specific IP immediately
config firewall address
 edit "Attacker_IP"
 set subnet 203.0.113.42/32
 next
end

SSL-VPN Setup (remote workers)

config vpn ssl settings
 set servercert "Fortinet_Factory"
 set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
 set port 443
 set status enable
end

config vpn ssl web portal
 edit "full-access"
 set tunnel-mode enable
 set ip-mode range
 set split-tunneling disable
 next
end

# Add user to SSL-VPN group
config user local
 edit "ganraj"
 set type password
 set passwd "SecurePass123!"
 next
end

View logs & blocked traffic

# View forward traffic log
execute log filter category 0
execute log display

# View IPS events
execute log filter category 2
execute log display

# View web filter blocks
execute log filter category 5
execute log display

# Real-time traffic debug
diagnose debug flow filter addr 10.0.0.5
diagnose debug flow show function-name en
diagnose debug flow trace start 100
diagnose debug enable
# (run traffic, then)
diagnose debug disable

🛡️ How FortiGate Blocks Unauthorized Access — 6 Real Scenarios

🔴 SQL Injection on Web App

Attacker sends ' OR 1=1-- in login form via HTTPS

FortiGate Steps:

1. SSL Inspection decrypts HTTPS
2. WAF profile scans HTTP body
3. SQLi signature matched
4. Request BLOCKED before server
5. Alert: Web Attack: SQL Injection
6. Source IP added to quarantine

🟡 Malware Download via HTTP

User accidentally clicks link, browser downloads infected .exe

FortiGate Steps:

1. HTTP traffic hits AV profile
2. File proxy buffers download
3. FortiGuard AV scans payload
4. Trojan.Generic signature hit
5. File BLOCKED, user gets warning page
6. Log: user, filename, hash, verdict

🔵 Zero-Day via FortiSandbox

Brand new malware not in AV database sent as email attachment

FortiGate Steps:

1. AV scans — no signature match
2. FortiSandbox cloud detonates file
3. Sandbox sees malicious behaviour
4. Verdict: MALICIOUS (5 min)
5. File blocked, hash added to DB
6. All FG worldwide updated instantly

🟡 Employee Using Unauthorized App

Staff installs personal Telegram on work PC — security policy forbids it

FortiGate Steps:

1. Application Control detects Telegram
2. App signature: Messaging/Telegram
3. Policy: Block category Messaging
4. Connection RESET to user
5. Block page shown in browser
6. Manager notified via FortiAnalyzer

🟢 Remote Worker SSL-VPN

Engineer works from home — needs access to internal GitLab and servers

FortiGate Flow:

1. FortiClient app connects to :443
2. MFA: FortiToken push to phone
3. Auth OK → SSL-VPN tunnel up
4. Gets IP 172.16.0.x
5. Policy VPN→LAN ACCEPT with IPS
6. Access to GitLab 192.168.1.50 ✅

🔴 DDoS / Flood Attack

Botnet sends 100,000 SYN packets/sec to overload web server

FortiGate Steps:

1. DoS policy detects SYN flood
2. Threshold exceeded (1000 SYN/s)
3. SYN cookie mechanism activated
4. Legitimate traffic passes through
5. Attack traffic DROPPED at wire speed
6. FortiGuard blocks botnet IPs

🧬 FortiGuard — The Intelligence Behind Every Block

🦠

AV & Sandbox

50M+ malware signatures updated every 60 seconds from FortiGuard cloud

🌐

Web Filter

3B+ URLs in 80+ categories. Updated in real-time. Block gambling, adult, malware in one click

💥

IPS Signatures

20,000+ attack signatures. Covers CVEs within hours of disclosure. Virtual patching for unpatched servers

📱

App Control

9,000+ applications identified by behaviour. Detect Tor, P2P, proxies even on non-standard ports

FortiGate vs WatchGuard vs pfSense — When to Use Each

FortiGate

Medium to large enterprises. Need ASIC speed + UTM in one box. SD-WAN. Fortinet Security Fabric integration. FortiAnalyzer for SIEM.

WatchGuard

SMB to mid-enterprise. Easier GUI. Dimension reporting built-in. Good for MSPs managing many clients. Slightly easier than FortiGate for non-experts.

pfSense / OPNsense

Home lab, small office, DevOps homelabs. Free and open source. Run on any x86 hardware or VM. Maximum flexibility but no commercial support.