XG Firewall and Netflix

Hi,

you could try to refer on this: https://community.sophos.com/kb/en-us/125061

let us know of the results,

Thanks,

Rap

Hi,

Thanks, I have followed that link, it is very similar as to what Aditya wrote, it has made no difference.

Thanks

hi daniel,

I can see that the info didn't work, thanks for the feedback, thus kindly try creating a firewall like this: 

and create a clientless user for the specific IP range that would access netflix.

This did the trick for us, kindly let us know how it goes for you.

regards,

Rap

Thanks, I will try this but if you don't mind do you mind stepping me through the creation of the clientless user too as I have not had much experience with the XG as of yet.

Cheers

hi henry,

what version of sfos are you currently running?

thanks

hi henry,

what version of sfos are you currently running?

thanks

SFVH (SFOS 16.05.5 MR-5)

please refer to this kb in creating clientless users: https://community.sophos.com/kb/en-us/123039

let us know how it goes

regards

Rap

Thanks Rap,

So I created a clientless user as per your KB, thank you. It was in a different place than the KB.

Configure --> Authentication --> Clientless Users

I created it as Apple TV - Username ATV - IP address 192.168.1.111 - Clientless Open Group - Traffic Shaping: High Guarantee User - Quarantine Digest: Disable

I then created a User/Network Rule:

Position Top (as i am pretty sure the XG reads Top to Bottom)

Source Zone: LAN

Source Network: Home (192.168.1.0/24)

Destination Zones: WAN

Destination Networks and Services: Any

Identity - Match Known users with "ATV" listed as a user or group

All Malware scanning unchecked

All advanced set to "none" with only NAT & Routing as Rewrite Source address

Log Firewall Traffic: Checked

Does that look correct to you? If so, I will give it a try.

Thanks!

hi Daniel,

kindly edit the destination network, your current setting is "any" it seems all outbound traffic will pass through this rule and supersede bottom firewall policies,

hence, put the ip address of netflix in the destination network or fqdn instead of any.

let us know how it goes,

regards

Rap 

Hi Rap,

Thanks for the pickup but Netflix uses multiple IP's and multiple FQDN's so how did you achieve this as I am unsure how I can put one single IP address into there?

when you configured a fqdn, xg would automatically resolve all ip that associates with netflix. give it a try, let us know how it goes

regards

rap

OK, Thanks; so a quick google search found:

1. netflix.com
2. nflximg.com
3. nflximg.net
4. llnwd.net

So I added those 4 under System --> FQDN Host

Then Created a Host Group Called Netflix Host Group

Then added that host group under Destination Networks.

I will give this a try shortly.

Thanks

Rap, it looks like all of your suggestions helped!

The rule is working perfectly!!! 

Thanks so much!

I should also make note of one unrelated matter for anybody starting out

Protect --> Intrusion Prevention --> DOS & Spoof Protection --> DOS Settings --> TCP Flood absolutely kills my connection. I go from 96/38mb to 1/1mb

Hi All, 

Have updated the Netflix list and also check the Drop packets if any via command. 

console drop 'host <Src Address>

^https?://([A-Za-z0-9.-]*\.)?ne?t?fli?x(img|ext|video)?\.(com|net)/
^http?://[A-Za-z0-9.-]*netflix.com/
^http?://[A-Za-z0-9.-]*nflximg.com/
^https?://([A-Za-z0-9.-]*\.)?nflximg\.com\.?/
^https?://([A-Za-z0-9.-]*\.)?nflxvideo\.net\.?/
^https?://([A-Za-z0-9.-]*\.)?netflix\.com/
^http?://([A-Za-z0-9.-]*\.)?netflix-*.vo.llnwd.net/.*
^https?://secure\.netflix\.com/*
^https?://uiboot\.netflix\.com/*
^http?://23.246.[0-63].*
^http?://37.77.1(8[4-9])|(9[0-1])].*
^http?://45.57.([0-1][0-1][0-9])|(12[0-7]).*
^http?://64.120.(12[8-9])|(1[3-9][0-9])|(2[0-4][0-9])|(25[0-5]).*
^http?://66.197.(12[8-9])|(1[3-9][0-9])|(2[0-4][0-9])|(25[0-5]).*
^http?://108.175.(3[2-5,8,9])|(4[0-4,6,7]).*
^http?://185.2.22[0-3].*
^http?://185.9.(188)|(19[0-1]).*
^http?://192.173.(6[4-9])|([7-9][0-9])|(10[0-9])|(11[0-7]).*
^http?://198.38.(9[6-9])|(10[2-3,8-9])|(11[0-9])|(12[0-5]).*
^http?://198.45.(4[8-9])|(5[2-8])|(6[1-3]).*

Hi Aditya Patel please make sure that you post that list with correct syntax. I know that it has been corrected in the KB article  https://community.sophos.com/kb/en-us/125061 after I had problems with it earlier

For example I had unexpected results with the regex

^http?://198.45.(4[8-9])|(5[2-8])|(6[1-3]).* and was fixed by correcting the syntax to

^198\.45\.(4[8-9]|5[2-8]|6[1-3])\.*

Michael Dunn correctly identified the issue with the regex and the problem I was having and fixed the KB article.

Also on a side note, I understand people using regex to bypass traffic for their phones/tablets and computers but it makes more sense to me to completely bypass webfiltering in firewall rules on pure streaming devices like roku, amazonfire, or appleTV etc.