# Firewall source location rule ignored

**URL:** <https://community.ipfire.org/t/firewall-source-location-rule-ignored/7977>\
**Category:** Firewall Rules\
**Created:** [30 May 2022 11:36 UTC](https://community.ipfire.org/t/firewall-source-location-rule-ignored/7977 "2022-05-30T11:36:01Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\
**Post date:** [6 June 2022 11:14 UTC](https://community.ipfire.org/t/firewall-source-location-rule-ignored/7977/4 "2022-06-06T11:14:06Z")

</div>

Hi,

> [@marco](#):
>
> My ISPs IP here is 213.249.8.xxx, this is Greece, I’m sure.

for the records: It is indeed.

```auto
[root@maverick ~]# location lookup 213.249.8.0
213.249.8.0:
  Network : 213.249.0.0/19
  Country : Greece
  Autonomous System : AS12361 - VODAFONE-PANAFON HELLENIC TELECOMMUNICATIONS COMPANY SA

```

> [@marco](#):
>
> Can anyone please check, if there is a problem in core 167 with the location based rules before I file a bug report.

To the best of my knowledge, no such general issue is known.

Once in a blue moon, [there were people on the forum complaining about their IPFire’s SSH port being erroneously exposed to the internet](https://community.ipfire.org/t/how-to-disable-ssh-from-red/4030), but we unfortunately never managed to find the root cause for these incidents, and I was unable to reproduce it by any means. ☹

Trying to reproduce your problem, I noted that creating such a rule as (3) causes an unintended (?) side-effect: Despite being NAT’ed, port 222 becomes reachable from the country in question. This is explicitly configured by rule (4) in your example, but seems to be a quirk in the firewall engine for rule (3) as well.

I will raise a bug for this, which only appears to affect port forwardings to IPFire itself, so it is not a complete disaster. 🙃 **EDIT:** Bug [#12873](https://bugzilla.ipfire.org/show_bug.cgi?id=12873) has been filed for this.

However, as @lowres already noted, a VPN would be the better approach.

Thanks, and best regards,  
Peter Müller

---

_[View the full topic](https://community.ipfire.org/t/firewall-source-location-rule-ignored/7977)._