Rules are not applied correctly

Hi Catalin,

I have had a quick look at your rules and can see a number of holes.

a summary of blocking access

1/. You need a block rule times

2/. you need an equivalent allow rule times

3/. you need to block access to that site/s in every other rule.

4/. you will need to reduce your use of any service too specific services.

5/. and where possible avoid using a generic internet access rule because all traffic will eventually find it way there.

Those are some thoughts for you until I can look on a bigger screen or some other forum members add to your thread.

ian 

Hu Catalin,

rule 6 (really rule #9 if reviewing in log viewer) blocks nothing, it is an allow all rule.

Ian

Even seems an allow all rule, the filter is a deny all.

I've been done more searches and I was able to isolate a bug like:

In case of a rule that combines (LAN[MAC1, MAC2],Application filter)->WAN, sophos makes an "OR" between [MAC] filter result and the Application filter, capturing all the traffic from that MAC(in this case youtube, but also other forbiden traffic).

However, this is not the only one

Hi Catalin,

you would have to disable the web exceptions for that to work successfully.

ian

WEB->Exceptions been all disabled(off). The same result. The bug from above is still there.

Also you will need to have an ips policy in place otherwise the detection function does not work and be using the proxy.

ian

There are a lot of entries in Intrusion Prevention-> IPS Policies.

Can you be more explicit about the policies content ?

Just select the lan to wan general will be sufficient for what you are testing.

thay are basically templates to build your own, but more on that later if you choose to stay with the XG.

ian

Those been there all the time. 

Yes, that incorrect, but you are not using them in your rules and to identify applications you need to select one of them is each firewall rule.

Ian