Source country
A Source GeoIP profile names the countries that may connect. The country is the client's, because the server is already inside your network.
Security topology · 04
Prerouting Filtering Rules
A published service can be limited by the client's country, the client's address, and a time window. Prerouting makes that decision before the appliance chooses a route to the real server.
Published service
Country, address, and a time window, before the real server
A published service is the address and port the internet uses to reach an internal host. Prerouting can require three things of that client. Fail one and the packet is dropped. It is not given a route, a NAT slot, or a session to the real server.
Source address
An address object limits who may connect: one address, a range, or a list. A client outside that object is dropped with the rest of the rule.
Time window
A time profile is a weekly schedule. Each day can allow a window from a start time to an end time, such as 08:00 to 17:00. Outside every window, the profile's default action applies: allow or block.
FortiGate VIP and Palo Alto destination NAT usually translate the published address, then apply geo and a schedule on the security policy. The path toward the real host is already chosen. TOORCE keeps the country, the source address, and the time window on the published service, and drops a miss before that route. FortiGate and Palo Alto are trademarks of their owners. This is where the check sits. Those products also offer geo and schedules.
Why it is earlier than a normal firewall rule
A forward rule runs after the appliance has accepted the packet and picked a path. That is the right place for “this user may reach this server.” It is the wrong place for “this packet should never be routed,” “this web session must be steered into the filter,” or “this local service port must be accepted before anything else looks at it.”
Vendors such as FortiGate and Palo Alto hide this step inside local-in policy, DoS policy, or a virtual wire. TOORCE keeps it as an explicit early stage: NAT and mangle rules in PREROUTING, then the forward policy. Web filtering on a rule is steered with TPROXY into the filter before the session is treated as ordinary forwarded traffic. Admin and SD-WAN service ports can be accepted at the front of that chain so management and overlay traffic are not waiting behind a long rule list.
What the business gets
- A published web, mail, or remote-access service accepts only the countries, addresses, and hours you set.
- Unwanted traffic is discarded before it consumes a route, a NAT slot, or a WAN link.
- Web inspection is guaranteed for the rules that ask for it, instead of depending on the client to use a proxy address.
- Management and SD-WAN ports stay reachable even when the forward policy is strict.
- Per-interface NAT redirect keeps admin access on the intended listen ports and can sink it when that interface should not offer it.
How it works
On each interface, PREROUTING owns the early accept and redirect decisions. A rule that publishes a service can require a source country, a source address, and a time profile before that packet is treated as forwarded traffic to the real server. The time profile is a weekly schedule: each day has windows from a start time to an end time, and a time outside those windows follows the profile's default action. Forward rules then apply the security profiles. When a rule enables web filtering, matching traffic is redirected to the transparent proxy and the filter profile for that rule. When web filtering is off, the packet returns to normal forwarding.