Hi all

I've got a country object (China and Russia) that blocks LAN > WAN in my firewall.   However its blocking IP ranges that are directed to the Akamai network (Playstation Network in this case).

The 95.100.164.16 IP is being blocked as I'm guessing the Draytek 'thinks' the IP is based in one of the blocked countries.

Is there a way to block a country but allow specific IPs through which aren't from that country but the Draytek 'thinks' are from a blocked country?

Hi Jonathan,

You can create a ‘Pass Immediately’ rule for the specific IP you want to allow through, but place that before your Set 2 Rule 4 rule.

OR

If you created a ‘Block if no further match’ rule for the country object, then you can place the ‘Pass Immediately’ rule after the Set 2 Rule 4 rule.

One quick note to be aware of, make sure you have set the ‘Next Set #’ option, in the lower right corner of the ‘Set’ page, if you are using multiple pages of rules, otherwise the rules will never run, as the list will stop at the bottom of the last page where the ‘Next Set #’ was left un-chosen.

HodgesanDY wrote:

Hi Jonathan,

You can create a ‘Pass Immediately’ rule for the specific IP you want to allow through, but place that before your Set 2 Rule 4 rule.

OR

If you created a ‘Block if no further match’ rule for the country object, then you can place the ‘Pass Immediately’ rule after the Set 2 Rule 4 rule.

One quick note to be aware of, make sure you have set the ‘Next Set #’ option, in the lower right corner of the ‘Set’ page, if you are using multiple pages of rules, otherwise the rules will never run, as the list will stop at the bottom of the last page where the ‘Next Set #’ was left un-chosen.

 

Hi HodgesanDY

I've tried the rules but neither of them work, here's my rule: 

Pass rule contains the following IPs (these are what were being blocked when I checked the Draytek firewall logs):

95.100.165.205
95.100.164.8
95.100.164.222
95.100.164.16

Then the block rule is underneath (block if no further match) - The block rule contains a Country object which I named 'Block' - this contains China, Hong Kong and Russia.

The IPs I'm trying to Whitelist are for the Playstations - namely the Playstation Network which uses Akamai Technologies.  If I remove Russia from the Country Block, the Playstation can connect fine to PSN.

My guess is because Russia is so vast, there's going to be a lot of IPs in that range which are creating false positives. For example I've noticed the router blocks IP ranges from Countries such as Netherlands even when I cite Russia as a country object to block. Am I right in thinking that the IPs for countries are contained within the firmware of the router?

I also have 'DoS Defense' enabled which blocks my country object containing russia, china and hong kong: screenshot here

I might just have to remove Russia as a country from the object for now.   It's the only way I can get this to work.  Akamai is so vast that I'll probably be forever whitelisting IPs anyway

Thanks for your help.