Userportal accessible from wan when SSLVPN uses TCP/443

Question

SFOS18.5.2 
 If SSLVPN is set to tcp/443 and is allowed on the WAN zone, either completely or due to an exception rule, it also grants access to the userportal, even if it's blocked. 
 
 it does not matter if the exception rule contains 
 "userportal drop" 
 or 
 "sslvpn allow" 
 
 the objects are basically the same (tcp/443) and what ever matches first counts.

LuCar Toni · Answer

See documentation: https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Administration/DeviceAccess/index.html#best-practices 
 
 If you manually change the default ports, we strongly recommend using a unique port for each service. Using a unique port ensures that services are not exposed to the WAN zone even after you turn off access. Example: If you use port 443 for both the user portal and SSL VPN, the user portal will be accessible from the WAN zone even if you turn off WAN access from this page.

Userportal accessible from wan when SSLVPN uses TCP/443

Top Replies

Submitted a Tech Support Case lately from the Support Portal?