Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 9008 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Tor is passing Sophos firewall rule

Mike Cruz

Hi, was able to block successfully tor network, but today i realize that it was working again, im blocking "Can bypass firewall policy, Tunnels other apps, Proxy and Tunnel" and allowing (in the same profile) Web Mail, File Transfer, Social Networking, Teamviwer conferencing and filetransfer, FTP/S-Data, FTP/S-Datatransfer, FTP/S-Control, FTP/S-Delete Request, FTP/S Download Request cuz i need them.

 

The original idea es to block ultrasurf and tor, and days ago it was completed blocked as i just said, but today tor is working again (slowly), ultrasurf is blocked yet, so i dont know if sophos use a database of ips for the tor network and maybe needs to be updated.

 

Does anybody knows something about? thanks a lot.

 

4010.Sophos.pdf



This thread was automatically locked due to age.
Parents
  • 0

    Hi Mike,

    Check the pattern for IPS from System>Back Up & firmware> Pattern> IPS. It should be the latest pattern available; 13.3.17.

    Now configure application filter and block TOR signature. Define the filter policy in the Firewall rule which forward the traffic from LAN to WAN. Refer: https://community.sophos.com/kb/en-us/123102

    Make sure HTTP & HTTPS scanning is applied in the Fw-rule and the IPS maxpkts is set to 100. To do this execute, In console > set ips maxpkts 100

    Thanks

Reply
  • 0

    Hi Mike,

    Check the pattern for IPS from System>Back Up & firmware> Pattern> IPS. It should be the latest pattern available; 13.3.17.

    Now configure application filter and block TOR signature. Define the filter policy in the Firewall rule which forward the traffic from LAN to WAN. Refer: https://community.sophos.com/kb/en-us/123102

    Make sure HTTP & HTTPS scanning is applied in the Fw-rule and the IPS maxpkts is set to 100. To do this execute, In console > set ips maxpkts 100

    Thanks

Children
No Data