This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to allow the traffic to specific IP that Sophos is blocking

For unknown reason, my Sophos XG is blocking specific IPs. Every few minutes, in the log viewer, i see a new denied package. How i can allow the traffic to this IP, and why it is blocked by the firewall ?

This thread was automatically locked due to age.

0 Keyur over 5 years ago

Hi Alex Kal

If you see the last column of the provided screenshot, it will provide the reason for denied traffic.

For Firewall Rule ID 0 - https://community.sophos.com/kb/en-us/131968

Some of the packets which are RST - TCP Reset packet denied in the firewall rule number 3, In the stateful infection and in connection tracking, if the traffic is not matched then the firewall will drop the traffic.

If you think that this is legitimate traffic and users is facing the issue, you can create Source IP host or IP host group based firewall rule and allow the traffic - https://community.sophos.com/kb/en-us/123579#Server-based%20routing, please use this article as reference and you can create a firewall rule and move the rule on top to allow the traffic.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to Keyur

Hey @Keyur . That's what i did right now:

1) Created new IP host with that IP in hosts and services.
2) Created Network address translation in Profiles.
3) Created firewall rule, using the above as outbound address.

That Didn't work. What i did wrong ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Alex Kal

Hi Alex Kal

Could you please let me know what issue are you facing? What specific access do you want to allow to the user? Please apply Default MASQ on the firewall rule and also verify the ISP gateway selected in the firewall rule.

For Denied messages, I have shared the details and no legit traffic is being denied, It would be great if you could share the screenshot of the firewall configuration.

You may use the packet capture - https://community.sophos.com/kb/en-us/123189
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to Alex Kal

Hi

as Keyur advised you have a rule problem.

From the log that traffic is incoming not outgoing?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 notapplemaxwindows1 over 5 years ago

Could that be whats app traffic? that's what I'm getting when doing a generic lookup for that IP.

Do you have any web protection turned on? maybe uncheck Enable pharming protection. PROTECT > WEB > GENERAL SETTINGS > expand advanced.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to rfcat_vk

Hey . I'm not sure, maybe yeah. But sometimes i get denied packages for both ways.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to notapplemaxwindows1

Tried it, didn't helped. Still seeing denied packages in the log viewer.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to Keyur

Hi again. This is my rule, in case that screenshot helps.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Alex Kal

Those packets do not indicate any problem at all.

I advice customers to disable the logging of Invalid Traffic, because it does not grant useful insights in traffic.

The main question is: Do you have any issues in your network or only does packets?

If only logging is the main concern, disable the logging.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to LuCar Toni

Hey. Yes, i got some problems. This is outside network, in which i want to connect.
Cancel
Vote Up 0 Vote Down

Cancel