URL still blocked after making exception

Looking at the URL being blocked in the Logs, shows It's not hitting the exception you created, so It might be Regex.

Can you try to use: "^([A-Za-z0-9.-]*\.)?ubuntu\.com\.?/" Instead of the one you just created?

Thanks!

Aha! That partially fixed the issue! Thanks!

The rule appears to be working (I get a green web filter entry in the logs stating that the connection was allowed), but the client still can't communicate with the server. In the log I also see a bunch of "Invalid TCP RST" and "Could not associate packet to any connection" when I run the update command, and the client gives a 502 Connection Refused error.

Reading on the forums it looks like people are mostly saying that this is just a log that can be ignored, but it's the only entry that I am seeing at the times of the update. Is my exception still not complete, or are these really unrelated? I've attached a screengrab below.

Thanks and best!

Mike

Hi,

yes you can ignore them. Now check that the Ubuntu is the only url being used and more than likely the issue is with the scanning process, some applications do not like working with a proxy even with exceptions.

Ian

Odd, even if I fully disable all scanning (web policy, scanning http and ftp, google QUIC blocking) it still isn't able to connect.

Is there anything I missed that would be causing the proxy issues? Or does it pass through a proxy regardless of what is set to be scanned?

Also, is there a permanent solution to applications that don't work with proxies? Turning off security for each update cycle doesn't seem ideal.

Thanks!

Mike

Is there something similar to the http proxy cache mentioned in this old UTM thread? (https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/43396/debian-apt-programs-fail-through-proxy)

It's the most similar problem I've been able to find, but I'm not seeing anything comparable in XG.

Thanks!

MIke

Hi Michael,

which version of XG are you using? If you are using v18 I suggest you upgrade other latest version before doing anymore testing.

Ian

Thanks to your suggestion earlier I got it! I created a firewall rule using the directions here (https://community.sophos.com/kb/en-us/128173) to bypass the web proxy for traffic directed to *.ubuntu.com, and updates are now able to function.