How do I block IPs in USG60?

DennisFi
DennisFi Posts: 2
First Comment Friend Collector
in Security

I do not have an IP Reputation feature or similar as described here below. So how do I add one, or several ip addresses to block to an USG60 firewall?

https://community.zyxel.com/en/discussion/15446/any-way-to-sync-blocked-ips-with-external-sources-usg-range

Accepted Solution

  • Zyxel_James
    Zyxel_James Posts: 663  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate 100 Answers
    Answer ✓

    Hello @DennisFi
    As @StefanZ suggested, if it's a large list of blocked IPs, you may try only allowing a few IPs.
    Or you can do it by manually adjusting your configuration file.

    • Download the startup-config.conf
    • open the .conf file with txt notebook
    • Find address-object address and object-group address
    • Then you can add the IP addresses in this format
      address-object x.x.x.x
      address-object y.y.y.y
    • And add an address group including the address-object
      object-group address
      address-object address name1
      address-object address name2
    edit address group object by configuration file.png

    This way is easier to add the address group if it's a large list.

All Replies

  • PeterUK
    PeterUK Posts: 3,503  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited March 2023

    If you know the IP, range, subnet or FQDN you can make a group list in objects > address then add to security policy > policy control for LAN to WAN or WAN to LAN source/destination as needed.

  • Zyxel_James
    Zyxel_James Posts: 663  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate 100 Answers

    Hello @DennisFi
    Welcome to Zyxel Community!

    • Go to Configuration > Security Policy > Policy Control, and click "Add" to create a policy rule
    • From: LAN1, To: WAN (the direction could be incoming too)
    • Source: specific LAN host. (For blocking incoming traffic, the Source could be an external IP address or FQDN)
    • Action: Deny
    16156 policy control.png

  • DennisFi
    DennisFi Posts: 2
    First Comment Friend Collector

    OK so I would have to do that for every IP or range then. I was wondering or hoping one might've had the ability to insert a lot of IPs in a list somewhere and tie those to a policy.

    I was considering making an app to connect to the firewall via SSH and automatically keep an list of blocked IPs.

  • StefanZ
    StefanZ Posts: 202  Master Member
    First Comment First Answer Friend Collector Community MVP
    edited March 2023

    Have a look at Configuration > Address/GEO IP > Address Group (if that feature exists on your device).

    Here you can bundle multiple Address Objects into a group which you can then reference in Policy Control.

    Generally I think you should do the reverse of what you want: Only allow certain IPs or ranges and keep everyone else out. Thats basically what a firewall does with the Default Rule – deny everything that is not explicitly allowed.

    Changing your config via SSH / CLI might also restart the device every time you alter the config. At least that is what happens via file-upload > apply or when replacing it via FTP…

  • Zyxel_James
    Zyxel_James Posts: 663  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate 100 Answers
    Answer ✓

    Hello @DennisFi
    As @StefanZ suggested, if it's a large list of blocked IPs, you may try only allowing a few IPs.
    Or you can do it by manually adjusting your configuration file.

    • Download the startup-config.conf
    • open the .conf file with txt notebook
    • Find address-object address and object-group address
    • Then you can add the IP addresses in this format
      address-object x.x.x.x
      address-object y.y.y.y
    • And add an address group including the address-object
      object-group address
      address-object address name1
      address-object address name2
    edit address group object by configuration file.png

    This way is easier to add the address group if it's a large list.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）