Web Protection rules not working

Hi Stefano,

Verify which firewall rule is blocking the website? Is it the one configured to do so or any other. Refer #1 in the Guide.

Thanks

Add port 3128 to the rule you want the traffic to match.

i.e. For a Web traffic rule you'd have ports 80, 443 and 3128

I had to do this after upgrading from v15 to v16 for proxied connections where the XG isn't the default gateway.

Charles is right. There was a bug in v16... maybe v15  (not tested) where explicitly defining http proxy port on the client side would bypass the proxy completely. https://community.sophos.com/products/xg-firewall/v16beta/f/sfos-v16-beta-issues-bugs/78763/default-drop-rule-not-working-as-expected/301218#301218 . They fixed it during the beta https://community.sophos.com/products/xg-firewall/v16beta/f/sfos-v16-beta-feedback/79313/direct-proxy-configuration-in-xg-v16-public-beta . 

You won't notice this if you have ANY in your services in the firewall rules but if you only allow needed protocols while trying to use XG as proxy only you will have to define port 3128

Charles is right. There was a bug in v16... maybe v15  (not tested) where explicitly defining http proxy port on the client side would bypass the proxy completely. https://community.sophos.com/products/xg-firewall/v16beta/f/sfos-v16-beta-issues-bugs/78763/default-drop-rule-not-working-as-expected/301218#301218 . They fixed it during the beta https://community.sophos.com/products/xg-firewall/v16beta/f/sfos-v16-beta-feedback/79313/direct-proxy-configuration-in-xg-v16-public-beta . 

You won't notice this if you have ANY in your services in the firewall rules but if you only allow needed protocols while trying to use XG as proxy only you will have to define port 3128

We still had the issue with 16.01.2 but we had been through the betas so a clean upgrade from v15 (where the problem didn't exist) to production v16 might not experience it.

I haven't tested if 16.05 GA has the same issue as we are now routing through the XGs

Cheers,

Charles