How to restrict Fortigate firewall WAN-side GUI to certain IP addresses (Untested CLI commands)

Subject: How to restrict Fortigate firewall WAN-side GUI to certain IP addresses (Untested CLI commands)

Good day from Singapore,

Fortigate firewall appliances are based on Linux.

I came up with the following CLI commands after studying an existing Fortigate 60F firewall configuration. These are untested CLI commands. Use them at your own risk!

The objective is to restrict Fortigate firewall WAN-side GUI to certain IP addresses.

config firewall address 

    edit "SKYNET_1"        

set subnet 1.2.3.4 255.255.255.255

    next

    edit "SKYNET_2"

set subnet 5.6.7.8 255.255.255.255    

    next

config firewall addrgrp

    edit "SKYNET"

        set member "SKYNET_1" "SKYNET_2"

    next

config firewall local-in-policy    

    edit 1                

set intf "wan1"        

set srcaddr "SKYNET"        

set dstaddr "all"        

set action accept        

set service "Fortigate_HTTPS" "SSH"        

set schedule "always"    

    next

Mr. Turritopsis Dohrnii Teo En Ming, 43 years old as of 28 July 2021, is a TARGETED INDIVIDUAL living in Singapore. He is an IT Consultant with a System Integrator (SI)/computer firm in Singapore. He is an IT enthusiast.

REFERENCES

==========

[1] https://marc.info/?l=netfilter&m=162747775219058&w=2