Blocking inbound traffic by country on a specific port

[JF1]

Hi

We have an externally facing NAT rule that is being attacked from various international locations.

We want to restrict traffic from the source countries, however only for the port we are using on the NAT rule.

I can see using layer 7 firewall rules we can block traffic from countries, however is it possible to take this one step further and not only block traffic from a country but only for a particular port?

[alemabrahao]

Unfortunately not. In your place I would remove the NAT, and allow access only via VPN

[Badr-eddine]

I didn't find a straightforward solution using Meraki MX since it lacks this feature.However, I previously managed this task with legacy Cisco ASA firewalls :). The workaround involves manually creating objects at the Meraki organization level for each CIDR and organizing them into object groups for each country or region, then setting up corresponding firewall rules. For instance, you can explore IP CIDR or range by country using resources like this example: https://github.com/herrbischoff/country-ip-blocks

Another consideration for the most secure approach is to eliminate this attack surface altogether and replace direct access with VPN connectivity.