Does port forwarding in opnsense bypass the firewall rules?

[mike366]

If I have an email server sitting behind an opnsense router, and the opnsense firewall blocks certain countries from access, if I port forward to the email server, are the blocked county ip rules enforced first, so that 'bad' traffic does not make it to the email server?

Thank you.

[Arakangel Michael]

Services > Intrusion Detection > 'User Defined' (Tab) >

GeoIP/Country
 ×United States (not)
 
GeoIP/Direction
 Source   
Action
 Drop

This will drop all traffic from every country other than the U.S. There is still plenty of 'bad' traffic here though, and people elsewhere can also use Tor, a VPN, or a 'zombie' (compromised) host.

[mike366]

Sure, thanks for the info.  At least it sounds like all packets not originating in US will be dropped before the port forward to the email server happens.  I appreciate the pointer on setup.

[Arakangel Michael]

Just to clarify, yes the traffic will be dropped.