The Smoothwall GeoBlocking rules allow you to block the IP ranges from single countries, continents or a mixture of the two.
On initial setup, Smoothwall does not block any IP ranges and Smoothwall versions prior to Leeds 46 do not have this feature available.
Blocking
Procedure
- On the NETWORK menu, under the Firewall submenu, click GeoBlocking
- In the Countries section, either select a full continent to block or click the + next to the continent to expand the select and select the required country
- Click Save changes
If a country or continent has been mistakenly selected, it can be deselected by clicking on the tick box next to the country or continent. Click Save changes to update the GeoBlocking selection(s)
Exception IPs
To allow specific IP addresses or ranges to still be allowed inbound access to Smoothwall after the country or continent has been blocked
Procedure
- Add the IP address or addresses into the Exception IPs input box. This can be in the format of a single IP address, an IP range or Subnet format. For example. 192.168.0.1, 192.168.0.1-192.168.0.254 or 192.168.0.0/24
- Click Save changes
Follow-up tasks
Exception IPs can be grouped together for easier future management and modification
When one or more IPs have been added, tick the option Save selected objects as group. Click Save changes
WARNING: It is possible to create nested groups of IPs when subsequent IP addresses or ranges are added and grouped together. These can be managed for deletion and/or updating on the NETWORK menu, under the Settings submenu, click Address object manager
Additional information: There are currently reserved codes which appear within the regions of Europe and Asia and are treated as a single country and not the whole region within the current region. Blocking Europe/Europe or Asia/Asia will not block the whole of these regions, but just the currently reserved code. If a whole region is needed to be blocked, do this by selecting the region from the top-level selection.
For example, Europe at the top level of the region will block all countries within this region (France, Greece, etc), Europe as a drill down within Europe only blocks EU for the ISO3166-1 code which doesn't exist as a true country, so as a will do nothing currently.
The ISO 3166/MA may reserve code elements for other entities that do not qualify for inclusion based on the above criteria. For example, because the European Union is not a country, it is not formally included in ISO 3166-1, but for practical reasons, the ISO 3166/MA has "reserved the two-letter combination EU for the purpose of identifying the European Union within the framework of ISO 3166-1"