Sophos Firewall

Discussions Question on firewall rules (XG210 17.0.0)

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 3 replies
Subscribers 27 subscribers
Views 5821 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Question on firewall rules (XG210 17.0.0)

SteveChung over 7 years ago

Hi,

I am using XG210 with 17.0.0 firmware in gateway mode.

I have 1-to-1 NAT host in LAN with specific WAN IP.

It works if I configure business application rule for services ICMP, SMTP and SSH with reflexive rule.

However, it seems reflexive rule permit any traffic from LAN. E.g. DNS and HTTP

How should I block DNS and HTTP services?

The other question is how can I restrict access of SMTP and SSH with various source?

E.g. Permit SMTP from 1.2.3.4 only and Permit SSH from 5.6.7.8 only

Please advies. Thank you!

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 7 years ago

Hi,

very simple, you build firewall rules for each item you want blocked with the highest priority blocking at the top, not he rule number.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 SteveChung over 7 years ago in reply to rfcat_vk

Thank you, Ian

Should I build business application rule for each service with different source?

Or single business application rule to permit all necessary services and source with reflexive enabled, then add user/network rule to reject before it?

I am confused on how they works.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to SteveChung

The reject should be at the top.

I would prefer a single rule for each item to be blocked, easier to debug and see what traffic is actually hitting the rule.

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rfcat_vk over 7 years ago in reply to SteveChung

The reject should be at the top.

I would prefer a single rule for each item to be blocked, easier to debug and see what traffic is actually hitting the rule.

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data