[SOLVED] XG Home : Website blocked even the policy allow all is selected

Hi Sophos Kynco 

Please create a source IP based LAN to WAN firewall rule and put the rule on top and test by applying only "allow all" web filter policy in the firewall rule on other scanning or restriction and then apply to scan and do not apply "allow all" policy and other restriction and test the result in both the scenario.

Hello,

Thank you for your answer.

I try this one:

When i apply "Allow all" for the web policy and disable scanning http : The website is blocked

When i apply "None" for the web policy and enable scanning http : the website is blocked.

When i apply "None" for the web policy and disable scanning http : the website is OK.

Regards

Kynco

Hi,

Yes to be more exatly, the website is not blocked but a small part not load in the webpage.

I try to add a web exclusion without success.

I will try to capture pcap, and i will give you the result in my next post.

Regards

Kynco

Hi Sophos Kynco 

Please refer to the article for web exclusion - https://community.sophos.com/kb/en-us/128173

Hi,

I try many things this evening :

When a i add a special rule (Specifiy for the destination *.sparklinlabs.com) without http scan and none policy it's ok. So the problem seem to be on this site.

I capture PCAP 3 times.

• 1 with policy allow all and scan http disable > Not OK
• 1 with policy none and scan http enable > Not OK
• 1 with policy none and scan http disable > OK!

May be the problem is theses packets no?:

Regards

Basically your testing shows that part of the site does not like to work through a proxy.

Pleas post a copy of your exclusion rule.

Ian

Hi,

I've not set drop rules, so i don't understand why theses packed are droped:

What do you mean by "Now using V18 GA on...". May be it's your signature?)

Regards

Hi Sophos Kynco 

I have tried to access the one drive URL but not able to access it, you could share it through personal message or attach them. What is 192.168.0.29? As per the screenshot, it is sending RST packet.

8867.TCPDUMP.zip

Hi,

You find in attachement the PCAP files.

The IP adresse 192.168.0.29 is the computer which access to the website.

Regards

Hi Sophos Kynco 

Thanks for pcap, please allow me some time to analyze them.

Hi Sophos Kynco 

The website which you are browsing is using "Websocket" protocol and currently web socket is not supported with XG web proxy. Due to that either with allow all or HTTP/s scanning it submit traffic to web proxy and creating a problem with website loading.

Ideas portal URL : https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/17526700-websocket

Work around: Create a destination IP or FQND based rule with no scanning and no policy on top to allow it for users.

Reference snapshot :

Hi,

Ok thank you for the information.

I try to view live log after set a filter to message="Invalid TCP RST."

But it seem to be difficult to know whitch packet are dropped for the Websocket not support reason.

So how i can determine witchs FQDN add in a generic rules?

May be it's possible to accept Websocket without Scan HTTP or Web proxy? It is possible to add a WebSocket passthrough?

I see many post witch talk about Websocket support by XG home. Have you any news about it?

Regards

Hi,

Ok thank you for the information.

I try to view live log after set a filter to message="Invalid TCP RST."

But it seem to be difficult to know whitch packet are dropped for the Websocket not support reason.

So how i can determine witchs FQDN add in a generic rules?

May be it's possible to accept Websocket without Scan HTTP or Web proxy? It is possible to add a WebSocket passthrough?

I see many post witch talk about Websocket support by XG home. Have you any news about it?

Regards

Hi Sophos Kynco 

As of now you may try with this FQDN hub.sparklinlabs.com and if needed then add this masterofthegrid.sparklinlabs.com without scanning and policy.

Hi,

Yes it's work. Thank you.

I would like to know how to easily find out which FQDN/IP address is blocked in the log center?
Is it possible to add a Websocket pass through?

Do you know when the Home edition will be support this?

Regards

Hi Sophos Kynco 

The shared FQDN extracted from the given pcap, you can also use the developer tool of the browser to check URLs/FQDNs.

As of now, WebSocket is not supported by the XG firewall and as Vishal_R has shared details in the previous response, please upvote for the idea - https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/17526700-websocket, Please submit your vote and keep the request in your watch list to have a further update.

Hi Sophos Kynco 

I have found the domain from working PCAP only which you uploaded in zip and you may check that snapshot which I have uploaded, in which you may confirm GET request is for which host domain for web socket transition.  

Regarding Weboscket once it will be supported by premier XG , It will be available for home edition as well with same version. For that you may keep provided Ideas thread in your watch list.

OK,

Thanks you for these information and  your very quickly support for this free edition :)

Best regards

Hi Sophos Kynco 

We glad that we could help you, please reach out to us for further assistance.

Vishal_R thank you for sharing your expertise.