Time & GeoIP LAN Access

Navigation: Scenarios → Time & GeoIP LAN Access

Allow LAN → WAN internet traffic only during working hours (Sunday–Thursday, 08:00–17:00) and only to approved destination countries, by creating a Time profile, a GeoIP profile, and assigning both on an inline rule.

Important — GeoIP placement: For outbound internet access, attach GeoIP as Destination GeoIP profile on the Security Profiles tab. For DNAT rules and published services (inbound), filter by client country using Source GeoIP profile on the Source tab — not Destination GeoIP profile.

Network design

LAN clients reach the internet through the TOORCE firewall. The allow rule carries a Time profile (when the rule is active) and a Destination GeoIP profile (which countries LAN users may reach). Inbound published services use the opposite GeoIP attachment point.

Figure 1 — Outbound LAN→WAN uses Destination GeoIP; inbound DNAT uses Source GeoIP

Reference topology

Policy flow (outbound)

1. Create Time profile → Sun–Thu 08:00–17:00 active
2. Create GeoIP profile → Allow US, GB, AE (whitelist); block all others
3. Inline rule: LAN → WAN, Action Allow
   → Security Profiles: Time profile + Destination GeoIP profile
4. Outside schedule or to blocked country → rule does not allow (next rule / implicit deny)
5. Install Policy

GeoIP profile placement — quick reference

Why: Outbound policy cares about where traffic is going (destination country). Inbound DNAT cares about who is connecting (source country on the internet side).

Prerequisites

• LAN and WAN interfaces configured (NAT Gateway)
• SNAT or outgoing NAT so LAN clients reach the internet
• Address objects for LAN_Network

Step 1 — Create the Time profile (Sun–Thu 08:00–17:00)

1. Go to Security Profiles → Time Profiles.
2. Click + Add New.
3. Configure:

Weekly schedule

Enable Sunday, Monday, Tuesday, Wednesday, Thursday only. Set each active day to 08:00 AM – 05:00 PM with action Allow. Leave Friday and Saturday disabled (no ranges).

4. Click + Create Record.

See Time Profiles.

UI note: The creation dialog may label the name field Address Object Name — enter your schedule name there (for example Work_Hours_Sun_Thu).

Step 2 — Create the GeoIP profile (allowed destination countries)

1. Go to Security Profiles → Geoip Security.
2. Click + Add New.

General tab

GEOIP Countries tab

1. Open GEOIP Countries.
2. Expand regions and set Allow on approved countries only. Use SET ALL → Block on each continent first, then Allow on specific countries.

3. Click + Create Record.

See GeoIP Security.

Step 3 — Inline rule: LAN → WAN with Time + Destination GeoIP

1. Go to Rules & Policies → Inline Rules.
2. Click + Add New (place above a general deny rule).

General

Interfaces

Source tab

Destination tab

Security Profiles tab

3. Click + Create Record.
4. Click Install Policy.

Expected results (outbound)

Verify in Logs & Events → Firewall Security — look for POLICY_NAME = LAN_Internet_Work_Hours_GeoIP and REASON for GeoIP/time mismatch.

Step 4 — DNAT / published service: use Source GeoIP (not Destination)

When you publish an internal service (mail, VPN portal, web app) with DNAT, restrict which countries may connect using Source GeoIP profile on the Source tab.

Example: HTTPS web server published on WAN

Do not assign Destination GeoIP profile on this rule. The server is inside your LAN; the country you want to filter is the remote client (source), not the destination.

Source vs Destination GeoIP — side by side

See X-Pool Overlapping NAT for DNAT rule structure.

Recommended rule order

Troubleshooting

Related documentation

• Time Profiles
• GeoIP Security
• Inline Rules
• NAT Gateway
• X-Pool Overlapping NAT