Allow Traffic through NGAF Geoblock

Newbie245553 Lv1Posted Mar-31-2026 09:57

Last edited by Newbie245553 Apr-01-2026 09:53.

I configured Geoblock in Policies > Access Control > Geoblock
I want to allow all traffic with destination port of smtp to go through
Does configuring an allow permission in Policies > Access Control > Application Control

SRC: Untrusted(WAN), all
Destination: Trusted(LAN), mailgateway, smtp
allow traffic to go thorugh when its smtp?

I also have the DNAT of

SRC: Untrusted(WAN), all
Destination: Public IP, smtp
Translate to: Mailgateway

This topic contains more resources

You must log in to download or view the file. Not registered yet? Register

x

By solving this question, you may help 970 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Damai_Group Lv1Posted Apr-02-2026 15:29
  
1.  In Sangfor NGAF, the processing of traffic is modular. The Application Control module is processed before the Content Security and IPS modules. This means your "Allow" rule in Application Control is evaluated before any IPS scanning occurs, but this rule sits within a specific module's policy list.

2.  For all policy types (Application Control, Firewall Rules, Traffic Shaping, etc.), the matching order is strictly top-to-bottom. The rule positioned higher in the list is always matched first. Therefore, the relative order of your Application Control rule and your Geoblock rule is critical.

3.  Regarding DNAT and your Application Control rule: DNAT is processed before the Application Control policy lookup. The firewall first translates the destination IP (from the WAN IP to your MailGateway's internal IP) and then evaluates the Application Control rule against the translated destination.

4.  Your Application Control rule (Source: Untrusted, Destination: Trusted -> mailgateway, Service: smtp, Action: Allow) is configured correctly to permit the traffic post-DNAT. However, this rule will only be effective if the traffic first passes the Geoblock check.

5.  The Geoblock feature, located under (Policies > Access Control > Geoblock), functions as a pre-filtering mechanism. If the source IP of an incoming SMTP connection belongs to a blocked country, the Geoblock engine will deny the session before it ever reaches your Application Control rule table.

6.  To resolve this, you have several options:
Move the Rule (Highest Priority): Ensure your Application Control "Allow" rule for SMTP is physically positioned above (with a lower rule number) any Geoblock rule in the main policy list. Sangfor's engine always stops at the first matching rule.

Use the Geoblock Exclusion List: From Sangfor NGAF version 6.8 onwards, an exclusion list is available in the Geoblock configuration. You can add the source IP of the specific sender or the destination IP of your MailGateway to this list to bypass Geoblock entirely. Note that some versions may only accept single IP addresses, not subnets.

7.  For SMTP traffic from a blocked country to successfully pass through the firewall, the traffic must first be processed by DNAT, then survive the Geoblock check (either by being excluded or skipped due to rule order), and finally be permitted by your Application Control rule. If Geoblock is placed above your rule, it will take precedence.
Muhammad Abid Lv2Posted Apr-02-2026 12:55
  
Geoblock rules have higher priority than normal Access Control policies.
❗ What’s happening:
You configured Geoblock → blocking countries
Then you created an Allow rule for SMTP (port 25) in Access Control
But Geoblock may still block the traffic before it reaches that rule

I Can Help:

Change

Moderator on This Board

1
148
3

Started Topics

Followers

Follow

948
193
98

Started Topics

Followers

Follow

Board Leaders