Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Answers 1 answer
  • Subscribers 30 subscribers
  • Views 20738 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Application filtering doesn't work

Per-OlofLitby

Please tell me what is wrong with my thinking.

I want to block game apps on weekdays for a number of hosts on the LAN. The instructions are straightforward. Create an application filter and use it in a firewall rule.

 

 

The only slightly confusing part in the instructions is that they show a check box for micro app discovery in the app filter - not present in v17-MR1.

This doesn't do anything to block games traffic - the firewall rule happily lets anything through.

If I turn on micro app discovery via the CLI, it causes all HTTPS traffic to fail with an invalid certificate error despite the fact all clients have the appliance certificate installed.

How do I set this up correctly?



This thread was automatically locked due to age.
Parents
  • 0

    Like I said, if I turn on micro app discovery via the CLI, it causes all HTTPS traffic to fail with an invalid certificate error.

    And why should I have to go into the CLI to change this in order to enable functionality which is in the web UI?

  • 0 in reply to Per-OlofLitby

    From memory during the beta v17 micro app discovery was turned on by default and for some stupid reason the management of the setting was removed from the GUI.

    I think you are going about the game blocking the hard way, there are default rules to block games and gambles which I use. Seems to stop most games.

    You would put that in the top firewall rule which has your time setting and then the other rules for general always access follow.

    You are also using decrypt and scan that will require the CA to be published to your users.

    Ian

  • 0 in reply to rfcat_vk

    Thanks Ian,

    I tried the easy way without success:

    https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/98269/struggling-with-game-blocking

    and so I tried the app filter.

    My certificate problems were caused by me not knowing that Firefox has its own certificate store :)

  • 0 in reply to Per-OlofLitby

    Im also struggling with App filters, I have been using the new Syncronised application controls now to add apps that XG and Central has found on my machine.  But the rules are still a bit hit and miss.  

    I still cant work out if i should be using App filters on there own like you have ie web filters set to none for the app filters to work correctly, but then if i do need to use Web filters with app filters the app filters seem to get ignored as i still see apps connecting to web sites that are either not in my app filter allow list or are in an app filter block list.  Sophos really needs to make it clearer on the best ways to use application control on there own and with web filters and also get them to work how they are set in the app filters.  IE if i setup allowed apps then id expect any apps not on my allowed app list to not get through the rule and vice versa with blocked app lists id expect them to just block the apps listed.

    Do you have Sophos Central too, as its definately worth trying to use Syncronized application control for your games as that way it will list the games exe path that is detected allowing you to create an app filter rule with those detected apps.  Maybe that method would work slightly better than the preset app lists, however as i say its still hit and miss if it will work...

    Which games are you trying to block?  Have you tried looking up the URLs used by the games from there support sites or google? That way you could create a firewall rule to block traffic to those FQDNs rather than using App filters.... Its worth a shot, the down side is in if there are a lot of URLs to enter.  Wildcard FQDNs help a lot however XG really needs a method to import Host lists from TXT / CSV files for FQDN hosts.  

     

    JK

  • 0 in reply to john_kenny

    Basically I'm lokking for a way to stop all the common game sites such as battlenet, origin, steam etc. while keeping a few, such as Discord, open. Don't have Sophos Central (home user).

  • 0 in reply to Per-OlofLitby

    Hi,

    I have just tried to download the battlenet application and failed 4 times, twice with FF and twice with Safari. In all cases the certificate failed, but when an exception was set the site was blocked by XG.

    Ian

Reply Children
  • 0 in reply to rfcat_vk

    can u screenshot your rules??

  • 0 in reply to john_kenny

    Hi,

    I am not sure what rules you want? The screenshot above is the firewall rule using the default settings? The only rule I have modified is the IPS where I removed the server and linux sub-set.

    Ian

  • 0 in reply to rfcat_vk
    1) Please do not turn microapp-discovery on.  This setting should be off for everyone except for special proof-of-concept demos.
    system application_classification microapp-discovery off
     
    2) The micro-app setting was removed from the application filter, with a redesign in 16.5 MR5 I think.  There was no benefit to ever having it turned off, and it only caused confusion and misconfiguration.  If there are KBs that need updated screenshots let me know the KB #.
     
    3) You have Services = Any. That makes this a pretty open and all encompasing rule and is generally a bad idea.  If you create all your rules like this you will most likely not be hitting the rule that you intend.  In fact, my guess as to why it is not working is that your traffic is hitting a higher-priority rule first.

    So lets say that you have a game that uses HTTP (port 80) to talk to the game server.
    If you have firewall rule 1 set LAN to WAN, Any service to all your...  whatever.
    If you have firewall rule 2 set LAN to WAN, HTTP/HTTPS service with a Web Policy to control all your web browsing.
    If you have firewall rule 3 set LAN to WAN, Any service with your Application Control blocking games.
    So now use a game.  It uses HTTP and hits rule 1 and is allowed.
    You temporarily turn off rule 1.
    So now use a game.  It uses HTTP and hits rule 2 and is allowed.
    You temporarily turn off rule 2.
    So now use a game.  It uses HTTP and hits rule 3 and is blocked by application control.
    Make sense?
     
    Once you've match a source/destination/port (service)/time for a firewall rule, that firewall rule is used for the traffic.  It does not then flow to the next matching rule.
     
    If you are still having problems, can you please post a screenshot of your firewall rules page.
  • 0 in reply to Michael Dunn

    Hi Michael,

    your answers in 1 and 2 above are a little confusing at least to me, 1 says off, 2 says on.

    Ian

  • +1 in reply to rfcat_vk

    1)

    The CLI global setting microapp-discovery should be off.

     

    2)

    The Application Filter Policy "Enable Micro App Discovery" checkbox is removed from UI as of 16.5 MR5.  Internally it is always checked (on).

     

    Conclusion:  Never let programmers name things.  :)