Block one IP, a group of malicious addresses, or a list that updates without repeated firewall changes.
Create an address object for the source IP, then place it in a deny rule above broader allow rules. Traffic aimed at the firewall itself, including VPN and administrator logins, may need a local or same-zone rule. For a long or changing list, give the firewall a URL to download instead.
Test a free 200-entry sample. No signup is required.
The correct rule depends on whether traffic crosses the firewall or terminates on the firewall.
| Firewall | Block one IP | Block many IPs | VPN or admin traffic to the firewall | Auto-updating list |
|---|---|---|---|---|
| FortiGate | Address object in a deny IPv4 policy | Address group | Local-in policy when the service terminates on a FortiGate interface | IP Address external feed |
| Palo Alto | Address object in a Security policy rule | Static address group; dynamic address groups use tags | Match the portal or gateway interface zones. An internet-facing untrust interface commonly makes this untrust-to-untrust traffic. | External Dynamic List |
| SonicWall | Address object in an access rule | Address group | WAN-to-WAN deny rule for SSL VPN or management on the WAN interface | Dynamic External Address Group |
These paths apply to FortiOS 7.2, 7.4 and 7.6. The local-in GUI changed in FortiOS 7.6.0.
A firewall policy controls traffic passing through the appliance. It is not the right control for a service terminating directly on a FortiGate interface.
Use a local-in policy. Fortinet defines local-in traffic as inbound traffic destined for a FortiGate interface and lists administrative access and VPN as uses.
FortiOS 7.2 and 7.4 require the CLI to create or edit a local-in policy. FortiOS 7.6.0 added Policy & Objects > Local-In Policy for GUI creation and editing.
config firewall local-in-policy
edit 0
set intf "wan1"
set srcaddr "Blocked-IP"
set dstaddr "all"
set service "ALL"
set schedule "always"
set action deny
next
endReplace the interface, destination and service with the narrow values for your deployment. Review existing local-in rules before inserting a deny rule.
At Policy & Objects > Addresses, select Address Group, create a group, and add the address objects as members. Fortinet requires addresses in a policy group to use compatible interface bindings; setting them to Any avoids mixing conflicting bindings.
Object capacity varies by FortiGate model and configuration. Check Fortinet's Max Value Table for the exact appliance instead of assuming one universal group limit.
Go to Security Fabric > External Connectors > Create New > IP Address. Choose the external-feed update method, enter the HTTPS URL, and set the refresh rate to 60 minutes. FortiOS imports one IP address, range, or subnet per line.
Use the connector as a source in the appropriate firewall or local-in policy. A threat feed can be a local-in policy source on FortiOS 7.2.4 and later and 7.4.0 and later; on 7.0, use a firewall policy instead. See the existing FortiGate protection guide for the complete VPN-feed setup.
diagnose user banned-ip manages FortiOS's banned-IP list, and security profiles can quarantine an attacker address. That mechanism is separate from a named address object or an external feed. Use it for a deliberate temporary or indefinite ban, not as a substitute for a reviewed policy.
The policy behavior below applies to PAN-OS 10.2 and 11.x.
Deny uses the application's default deny action. Drop silently discards matching traffic.
Palo Alto Networks tells administrators to place external GlobalProtect portal and gateway interfaces in an external zone such as untrust. If internet traffic enters an untrust interface and the portal or gateway IP is on an interface in that same zone, the Security rule must match untrust to untrust. Do not rely on the default intrazone rule, which allows same-zone traffic by default.
Confirm the actual interface, virtual system and zone design before creating the rule. The existing GlobalProtect protection guide covers the full setup.
PAN-OS provides predefined lists for Known Malicious IP Addresses, Bulletproof IP Addresses and High Risk IP Addresses when the firewall has an active Threat Prevention license.
A dynamic address group is different from a downloaded list. Its membership is selected by tags registered through supported sources such as the XML API, VM Monitoring or User-ID. For a hosted text file of IP addresses, use an External Dynamic List.
(action eq deny) and (action eq drop).test security-policy-match with the real source, destination, port, protocol, application and user values needed for your flow. The command reports the matching Security rule.test security-policy-match application ssl source 203.0.113.25 destination 198.51.100.10 destination-port 443 protocol 6The addresses above are documentation examples. Replace every value with the flow you are testing.
Use SonicOS 7 address objects and access rules. Select the zone pair that describes the destination.
For SSL VPN on the WAN interface, SonicWall documents a WAN to WAN deny rule with the unwanted address group as the source and SSLVPN as the service. Place it above the default SSL VPN allow rule. WAN management restrictions also use WAN-to-WAN access rules.
In SonicOS 7, go to Object > Match Objects > Dynamic Group and add a Dynamic External Address Group. For an HTTPS feed, enter the list URL, enable periodic download, and select 1 hour.
SonicOS creates a read-only Dynamic External Address Object for each line in the file. The file accepts one IP address or CIDR subnet per line. Those objects count against model-dependent address-object capacity, so check the Technical Support Report for the appliance's Max Address Objects Base. Do not assume one free-entry total for every model.
See the existing SonicWall protection guide for the complete rule and feed configuration, including which ThreatListPro file fits SonicWall's limits.
Use the platform-specific guide for the correct object, alias or policy workflow.
A hand-maintained group becomes stale when addresses change faster than an administrator can review and enter them.
A dynamic block list is a URL the firewall downloads on a schedule. Palo Alto calls it an External Dynamic List, or EDL; FortiGate calls it a threat feed. The file contains one IPv4 address or CIDR per line. Single IPs in the ThreatListPro feed are written as /32.
ThreatListPro covers 5.4M+ IPv4 addresses. It is built from real attacks on live production Palo Alto GlobalProtect VPN portals in the US and checked for new attackers every 6 hours. Configure the firewall to refresh it hourly, or use the nearest available option.
Read what a dynamic block list is, see the feed URL guide, or inspect the free 200-entry sample.
A new IP's first attempt still arrives. ThreatListPro is IPv4 only, and no list stops every brute-force or password-spraying attempt. CIDR ranges include addresses that did not each attack. A block list also does not replace MFA, secure authentication policy, current firewall software, monitoring or incident response.
A deny rule can lock out a real user or administrator if its scope is wrong.
Create an address at Policy & Objects > Addresses, then use it as the source in a deny firewall policy for traffic passing through the appliance. If the IP is reaching a VPN or administrator service on a FortiGate interface, use a local-in policy instead.
Create an address object for each IP and put the objects in an address group. Use that group as the source of one deny rule. If the set is long or changes often, use a URL-based dynamic block list instead of repeatedly editing the group.
Filter Monitor > Logs > Traffic by the source address and a blocked action, then inspect the Rule column. You can also test the flow with test security-policy-match. For a downloaded list, open Objects > External Dynamic Lists > List Entries and Exceptions and search for the IP.
It stops connections from that address only when the deny rule applies to traffic reaching the VPN service. Traffic terminating on a firewall may need a local-in or same-zone rule. A new attacker address can still make its first attempt, and no IP list stops every login attack.
Start with your firewall vendor's built-in reputation controls and your own reviewed incident data. ThreatListPro also provides a free 200-entry IPv4 sample with no signup. Test any third-party list against your users' source addresses before enforcing it.
They answer different questions. Geo-blocking limits traffic by mapped location, while an IP list targets selected addresses or networks. Use geography only when it matches a real access requirement. Neither method replaces MFA, authentication controls, monitoring or a rule that correctly protects the VPN service.
ThreatListPro covers 5.4M+ IPv4 addresses and is checked for new attackers every 6 hours. Monthly is $9.99 with a 14-day free trial and no card needed.
Start a 14-day free trial Or test 200 entries first: free, no signupUse the platform guide to connect a plain-text IPv4 list to the correct deny rule.
Continue with the definition, setup guide or comparison that matches your next task.