[SOLVED] XG Home : Website blocked even the policy allow all is selected

Hi Sophos Kynco 

Please create a source IP based LAN to WAN firewall rule and put the rule on top and test by applying only "allow all" web filter policy in the firewall rule on other scanning or restriction and then apply to scan and do not apply "allow all" policy and other restriction and test the result in both the scenario.

Hi Sophos Kynco 

Please create a source IP based LAN to WAN firewall rule and put the rule on top and test by applying only "allow all" web filter policy in the firewall rule on other scanning or restriction and then apply to scan and do not apply "allow all" policy and other restriction and test the result in both the scenario.

Hello,

Thank you for your answer.

I try this one:

When i apply "Allow all" for the web policy and disable scanning http : The website is blocked

When i apply "None" for the web policy and enable scanning http : the website is blocked.

When i apply "None" for the web policy and disable scanning http : the website is OK.

Regards

Kynco

Hi Sophos Kynco 

Could you please specificity "the website blocked" means, it is not loading or any block or error message?

Could you please try to capture working and nonworking pcap means, capture pcap with applying Allow all and capture another pcap with none web filter policy and share the pcap files.

Please refer to the article - https://community.sophos.com/kb/en-us/127647

If you want to allow the website you can add it in web exclusion

Hi,

Yes to be more exatly, the website is not blocked but a small part not load in the webpage.

I try to add a web exclusion without success.

I will try to capture pcap, and i will give you the result in my next post.

Regards

Kynco

Hi Sophos Kynco 

Please refer to the article for web exclusion - https://community.sophos.com/kb/en-us/128173

Hi,

I try many things this evening :

When a i add a special rule (Specifiy for the destination *.sparklinlabs.com) without http scan and none policy it's ok. So the problem seem to be on this site.

I capture PCAP 3 times.

• 1 with policy allow all and scan http disable > Not OK
• 1 with policy none and scan http enable > Not OK
• 1 with policy none and scan http disable > OK!

May be the problem is theses packets no?:

Regards

Basically your testing shows that part of the site does not like to work through a proxy.

Pleas post a copy of your exclusion rule.

Ian

Hi,

I've not set drop rules, so i don't understand why theses packed are droped:

What do you mean by "Now using V18 GA on...". May be it's your signature?)

Regards

Hi Sophos Kynco 

I have tried to access the one drive URL but not able to access it, you could share it through personal message or attach them. What is 192.168.0.29? As per the screenshot, it is sending RST packet.

8867.TCPDUMP.zip

Hi,

You find in attachement the PCAP files.

The IP adresse 192.168.0.29 is the computer which access to the website.

Regards

Hi Sophos Kynco 

Thanks for pcap, please allow me some time to analyze them.