So we have some certain ports being forwarded to an internal server and we have to use the "Any" tag to allow all clients to connect due to the clients being on dynamic WAN IP addresses.  However, occasionally I see foreign source country IP attempts at connecting on this port and I want to block these ranges but not the entire country.   The only place I see where I might be able to do this is the Layer 7 rules with Deny Remote IP Range.  I can't find any documentation on exactly what this option does if it is outbound only or both inbound and outbound.  Is that what this option is used for?   If not, is there any other way to "blacklist" incoming wan ip addresses in the "Allowed remote IPs" on the port forwarding section?  IE, could I use something like "any, not 123.456.789"? ... View more

I requested this feature a few years ago but I've never seen it come up again.  We have some users that have either read-only to the Organization or only to specific sites.  However, they are unable to manage the non-Meraki VPN without being an Organization level user which is too much access to grant them.   I don't see it too difficult to implement to just add another level of Privilege for just granting permission to that VPN settings section.  It would be even better if there was a way that users could be assigned permission only to modify non-Meraki VPN for the particular network they have rights to but I'm sure that is a more complicated change. ... View more