What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's from Russia/Netherlands etc hitting the firewall all the time. Sometimes the IP's are part of a botnet/wannacry affiliated or other malicious sources. The firewall quickly denies these packets but what Im trying to figure out what good would geoblocking do if the IP's are being blocked by the firewall's implicit deny rule anyway?

  • 2
    " The firewall quickly denies these packets ..." - are you implying that you believe that your firewall is able to block absolutely all packets from malicious sources (without any false positives)? In this case you would drastically overestimate the capabilities of your firewall und should better believe less in the marketing material provided by the firewalls vendor. – Steffen Ullrich Mar 16 at 22:41
  • Thanks Steffen, can you give me an example of when a NGFW firewall was not able to block a malicious packet? – errMSG Mar 17 at 2:41
  • In my scenario, it is a "closed" network. It does not provide any services other than VPN and a couple of IIS services. – errMSG Mar 17 at 2:49
  • The blacklists used by a firewall to block malicious sources (not "malicious packets") are about as reliable as antivirus or blacklists for spammer IP addresses. Yes, they block a lot but they don't block all. These are curated lists based on what is seen by the creator of these list at a specific time and both don't block everything and might also block some sources which are not or no longer malicious. There is no magic going on and there central place where attackers register their current source IP before they are doing an attack so that the IP can be blocked - so errors are unavoidable. – Steffen Ullrich Mar 17 at 6:28
  1. You may have services that you provide to the US that you do not want, or are not allowed to, provide to certain geographies. Examples: software downloads (particularly with Crypto) to countries on the federal crypto exclusion list. Video distribution to countries where you are not licensed to serve those copyrighted videos.

  2. If your web services are not used by certain countries, and those countries have a substantial quantity of attackers, by all means geoblock those countries. This is very helpful against "script kiddies" and random scans.

You are correct that blocking something that is already blocked has no purpose. Geoblocking is an additional block selectively preventing access to services you permit from some countries.

The protection geoblocking provides is imperfect. Attackers in country-A are only inconvenienced by a direct geo block and may use a jump host in country-B. Some people also use country-specific VPNs to bypass geographic video distribution restrictions. But every inconvenience you add may cause the attacker to focus elsewhere.

| improve this answer | |
  • Im not hosting any public services, this is a closed network. I only have a couple of network firewalls/routers/VPN's exposed. does that change the advice? – errMSG Mar 17 at 17:17
  • If your only public service is the VPN, and you have stateful firewalls, you have a very small ingress ACL and small set of possible vulnerabilities. In that case I’d concentrate on keeping your vpn servers patched and testing your IPv4/IPv6 VTY acls on your exposed network gear. – Darrell Root Mar 17 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.