[SOLVED] XG Home : Website blocked even the policy allow all is selected

Hi Sophos Kynco 

Please create a source IP based LAN to WAN firewall rule and put the rule on top and test by applying only "allow all" web filter policy in the firewall rule on other scanning or restriction and then apply to scan and do not apply "allow all" policy and other restriction and test the result in both the scenario.

Hello,

Thank you for your answer.

I try this one:

When i apply "Allow all" for the web policy and disable scanning http : The website is blocked

When i apply "None" for the web policy and enable scanning http : the website is blocked.

When i apply "None" for the web policy and disable scanning http : the website is OK.

Regards

Kynco

Hi,

I've not set drop rules, so i don't understand why theses packed are droped:

What do you mean by "Now using V18 GA on...". May be it's your signature?)

Regards

Hi Sophos Kynco 

I have tried to access the one drive URL but not able to access it, you could share it through personal message or attach them. What is 192.168.0.29? As per the screenshot, it is sending RST packet.

8867.TCPDUMP.zip

Hi,

You find in attachement the PCAP files.

The IP adresse 192.168.0.29 is the computer which access to the website.

Regards

Hi Sophos Kynco 

Thanks for pcap, please allow me some time to analyze them.

Hi Sophos Kynco 

The website which you are browsing is using "Websocket" protocol and currently web socket is not supported with XG web proxy. Due to that either with allow all or HTTP/s scanning it submit traffic to web proxy and creating a problem with website loading.

Ideas portal URL : https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/17526700-websocket

Work around: Create a destination IP or FQND based rule with no scanning and no policy on top to allow it for users.

Reference snapshot :

Hi,

Ok thank you for the information.

I try to view live log after set a filter to message="Invalid TCP RST."

But it seem to be difficult to know whitch packet are dropped for the Websocket not support reason.

So how i can determine witchs FQDN add in a generic rules?

May be it's possible to accept Websocket without Scan HTTP or Web proxy? It is possible to add a WebSocket passthrough?

I see many post witch talk about Websocket support by XG home. Have you any news about it?

Regards

Hi Sophos Kynco 

As of now you may try with this FQDN hub.sparklinlabs.com and if needed then add this masterofthegrid.sparklinlabs.com without scanning and policy.

Hi,

Yes it's work. Thank you.

I would like to know how to easily find out which FQDN/IP address is blocked in the log center?
Is it possible to add a Websocket pass through?

Do you know when the Home edition will be support this?

Regards

Hi Sophos Kynco 

The shared FQDN extracted from the given pcap, you can also use the developer tool of the browser to check URLs/FQDNs.

As of now, WebSocket is not supported by the XG firewall and as Vishal_R has shared details in the previous response, please upvote for the idea - https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/17526700-websocket, Please submit your vote and keep the request in your watch list to have a further update.

Hi Sophos Kynco 

I have found the domain from working PCAP only which you uploaded in zip and you may check that snapshot which I have uploaded, in which you may confirm GET request is for which host domain for web socket transition.  

Regarding Weboscket once it will be supported by premier XG , It will be available for home edition as well with same version. For that you may keep provided Ideas thread in your watch list.

Hi Sophos Kynco 

I have found the domain from working PCAP only which you uploaded in zip and you may check that snapshot which I have uploaded, in which you may confirm GET request is for which host domain for web socket transition.  

Regarding Weboscket once it will be supported by premier XG , It will be available for home edition as well with same version. For that you may keep provided Ideas thread in your watch list.