Skip to main content

Displaying a Blocking Page using your Firewall (FortiGate)

  • Updated

Note: This guide will setup a blocking page using a FortiGate Firewall, however there will be a discrepancy between the domain name specified by the client in the HTTPS request and the domain name on the SSL certificate of the FortiGuard blocking page. This mismatch triggers SSL validation problems, resulting in potential errors for clients trying to access the blocking page.

Prerequisites

Access to DNS Filter. You don't need the web filtering license, as we won't use the FortiGuard Category Based Filter to enable the blocking page, but create a custom Threat Feed.

Redirecting connections from the SecureDNS Sinkhole IP Addresses to the FortiGuard Portal IP (or a custom one)

  1. Select Security Profiles -> DNS Filter
  2. Select your desired DNS Filter Profile, and enable Static Domain Filter -> External IP Block Listsfw1.png
  3. Press the + icon next to External IP Block Lists, and click Create
  4. Choose a fitting name like "SecureDNS Sinkhole IPs" and leave External Feed on (default)
  5. In URI of external resource, paste the following link: 
    1. https://suspicious.secutec.be/sinkhole-addresses.txt
    2. If you would like to use this internally, you can copy the values of the txt file and host it on a local webpage instead
  6. Turn off HTTP basic authentication
  7. Leave Refresh Rate and Comments as desired.FW2.png
  8. Click OK
  9. Confirm the Connection is ok by hovering with your mouse over the added list, and select View Entries
  10. Confirm that every entry has a green check mark "Valid"FW3.png
  11. Press OK to save the DNS Filter Profile

Enable the correct DNS Filter Profile under Security Profiles in the correct Firewall Policy to enable the blocking page redirection whenever a domain was blocked by SecureDNS.

 

Related articles