Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 10 replies
  • Subscribers 28 subscribers
  • Views 14571 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WebRTC / Google Hangouts Blocked

Marc Herndon

Does anyone know if there's a way to get WebRTC traffic (used by Google Hangouts) to work through an XG firewall?

I just purchased two IP intercom units from www.nucleuslife.com, got them set up on my network, and confirmed that have Internet/WAN connectivity (I can ask Alexa to do things and get responses).  The problem is they cannot see each other on my LAN.  Each knows the other exists through my Nucleus account, but they show the other as "offline", thus cannot place calls.  I've gone through all my firewall, IPS, etc. logs and show no signs of any traffic being blocked or dropped.  I temporarily created new firewall rules allowing 'any' hosts and services from LAN to LAN, LAN to WAN and even WAN to LAN but it still didn't work.

I contacted Nucleus support and they said something in my network is blocking the WebRTC protocol.  Two direct quotes from them below:

  • "They should be able to contact each other without using the Internet. Are you able to use Google Hangouts on your network? We use the same protocol. Both TCP and UDP ports need to be available, but not any specific ones."
  • "As neither device is seen by the mobile app, it sounds like WebRTC is being blocked by some configuration."

With that information I decided to try placing a hangouts call from my PC on the LAN to my wife's cell phone.  It sat there saying "connecting..." but her phone never rang, nothing came through, and again, no blocked traffic in the various logs.  Googling for Sophos and Hangouts led me to these two links:

The second link is not helpful, other than to suggest that XG blocking Google Hangouts is a known issue?  The first link is specific to UTM, but suggests an external MTU-related solution.  I will look into that deeper this evening after work, but I don't suspect that will be my answer.  My devices are trying to talk LAN-to-LAN and per the support tech they should not need to go out to the WAN to connect.  As such, I don't think a WAN MTU setting could be the culprit?

Does anyone have any thoughts or suggestions?  Can anyone confirm that Google Hangouts is or is not working through their XG Firewall?

Thanks,
Marc



This thread was automatically locked due to age.
Parents
  • 0

    HI Marc, 

    We have not seen such issue , Could you let us know the Ports used for communication. Also allow us some time to simulate and also post any configuration used in application filter and Web filter used on the firewall rule 

  • 0 in reply to Aditya Patel

    OK final update, I swapped a Netgear R7000 in place of the XG firewall this afternoon and with the intercoms plugged into the Netgear directly, or with them plugged into a switch which was plugged into the Netgear, they came right online and were able to call each other.  So that pretty much ruled out that the problem could be anything but the XG firewall.

    I then decided since the network was already down I might as well go all out, and I reset the XG firewall to factory defaults.  When it came back up I stepped through the wizard, configured for Gateway mode, and allowed it to create the #Default_Network_Policy rule, with all LAN to WAN services allowed, no scanning, IPS, or web policy applied.  I then plugged the switch into the LAN port of the XG (the same switch that had just worked w/ the R7000), and the two intercoms into the switch.  As before, they obtained DHCP and had full Internet connectivity, but could not see or call each other.  As a final effort I created one more firewall rule allowing all LAN-to-LAN with no scanning, IPS or web poilicies, but as expected it made no difference.

    So in summary, through all of my troubleshooting, hardware swapping, and config resetting, I've determined beyond any possible doubt that the XG firewall is the culprit in blocking the intercoms from communicating.  I've also shown that it wasn't my original XG configuration causing the blockage, as a factory fresh unit with nothing but an "allow all" rule still blocks the intercoms.  It doesn't appear to be a firewall rule or related WAF/IPS/etc. policy that's doing the blocking, it has to be something lower level than that, likely something not accessible from the GUI.  I'm going to contact Nucleus again and find out if there's anything they do other than WebRTC, maybe some kind of handshake that XG is preventing, causing the units not to detect each other.  Anything that I find out I'll pass along.

    All that said, it seems like only an XG developer will be able to get to the bottom of this, but I'd greatly appreciate the help if anyone is willing.  @Aditya Patel?  I *REALLY* don't want to have to switch to a competing firewall solution, after spending the last couple months getting XG all dialed in and training my wife on how to use it :).  But I really need these intercoms to work... Thank you!

Reply
  • 0 in reply to Aditya Patel

    OK final update, I swapped a Netgear R7000 in place of the XG firewall this afternoon and with the intercoms plugged into the Netgear directly, or with them plugged into a switch which was plugged into the Netgear, they came right online and were able to call each other.  So that pretty much ruled out that the problem could be anything but the XG firewall.

    I then decided since the network was already down I might as well go all out, and I reset the XG firewall to factory defaults.  When it came back up I stepped through the wizard, configured for Gateway mode, and allowed it to create the #Default_Network_Policy rule, with all LAN to WAN services allowed, no scanning, IPS, or web policy applied.  I then plugged the switch into the LAN port of the XG (the same switch that had just worked w/ the R7000), and the two intercoms into the switch.  As before, they obtained DHCP and had full Internet connectivity, but could not see or call each other.  As a final effort I created one more firewall rule allowing all LAN-to-LAN with no scanning, IPS or web poilicies, but as expected it made no difference.

    So in summary, through all of my troubleshooting, hardware swapping, and config resetting, I've determined beyond any possible doubt that the XG firewall is the culprit in blocking the intercoms from communicating.  I've also shown that it wasn't my original XG configuration causing the blockage, as a factory fresh unit with nothing but an "allow all" rule still blocks the intercoms.  It doesn't appear to be a firewall rule or related WAF/IPS/etc. policy that's doing the blocking, it has to be something lower level than that, likely something not accessible from the GUI.  I'm going to contact Nucleus again and find out if there's anything they do other than WebRTC, maybe some kind of handshake that XG is preventing, causing the units not to detect each other.  Anything that I find out I'll pass along.

    All that said, it seems like only an XG developer will be able to get to the bottom of this, but I'd greatly appreciate the help if anyone is willing.  @Aditya Patel?  I *REALLY* don't want to have to switch to a competing firewall solution, after spending the last couple months getting XG all dialed in and training my wife on how to use it :).  But I really need these intercoms to work... Thank you!

Children
No Data