Clean Up rule "from any, to any, drop" that's allowed on the Internet anyway !!! WTF ?

Hi,

this not a serious issue. Where does this rule sit in the firewall rule list and what is its ID eg at the top. Why are you trying to block all internet access, this does not make sense?

What you are seeing in your log is traffic going out another rule eg rule id 3.

XG tests the packets from top down, not by rule number.

Ian

Hello rfcat_vk

Best practices guidelines for "serious" world-class firewall products requires the implementation of a least one "stealth" rule and one "clean up" rule.  By definition, a "clean up" rule is always the last ... It does what it says: drop everything that was not implemented on previous rules and logs it.

So, by definition, nothing is allowed by this rule, or after this rule !!!  Yet, we see some traffic is allowed.

My understanding here, is that's, on the contrary, an awful issue.

Hi,

yes world's best practice maybe if implemented correctly.

You didn't answer my question about firewall rule order. I have a drop everything that is left over on my XG and it occasionally catches stuff, usually when the external link fails, it is at the bottom of the firewall rule list.

I also have country/region drop for incoming and outgoing rules at the top of my firewall rules.

So please post a screenshot of your entire firewall rules.

Ian

Hey Big_Buck 

The XG has an implicit default deny action that drops traffic that does not match any existing firewall rule policies.
This rule that you have configured to drop any traffic is unnecessary and may potentially cause conflicts with your other existing firewall policies.

Regards,

FloSupport | Community Support Engineer

Hello

Our clean up rule no 3 is the last.  No other rule after that. It should drop everything left.  Now, even if it was not the last, logs are showing "Allowed" traffic.  It should be "Drop" !!!

The question asked here, is why do we still see outbound traffic with that rule no 3 since it is any-any-any-drop ?

Hello

Our clean up rule no 3 is the last.  No other rule after that. It should drop everything left.  Now, even if it was not the last, logs are showing "Allowed" traffic.  It should be "Drop" !!!

The question asked here, is why do we still see outbound traffic with that rule no 3 since it is any-any-any-drop ?

Hi,

two things, first please log a ticket with sophos support.

Secondly I would still like to see a screenshot of all your rules, just the overview would be fine.

Thank you

Ian

I'm very shy to post my rule set for confidentiality reasons.

I've open a case 3 days ago.  No news yet.  What could be more urgent to a firewall vendor but to investigate ipso-facto on what appears to be a leaking firewall ?

Hi Big_Buck.

I think you a configuration issue with your lan and interface, but I can't help unless I can see the firewall rules, even if you change or mask the critical parts.

Regards

Ian

Added extra info:- I took Flo's advice and deleted my drop all firewall rule at the very bottom of my firewall list. The dashboard information disappeared, but returned 20 minutes later, looks like a slow log file update.

Ian

How many firewall rules do you have?

Hello  Rules and network config.  Which are very basic and simple to me.

Hi Big_Buck,

thank you for taking the time to edit and post those screenshots. I think we a revoking for a loop between a couple of the rules which is causing the firewall configuration to fail.

At a suitable where you have at least 30 minutes I would disable all those rules except rule id 3 and then try accessing the internet, that should fail.

Let all rules applying to one interface back and try to access the internet noting if any traffic is reported in rule id 3, allow about 2 to 3 minutes for the configuration stables before each test.

Repeat this for each interface.

Ian

The thing is we have four Sophos firewalls.  Two of them being XG105W. They all behave the same even though XG105Ws have only 5 very basic rules.  They all leak.

I'll bet an arm and a leg yours do the same without you knowing it ...

Sophos call me this PM.  Could not make any sens out of it, archived this unresolved case, and ask me to call them back when it happens again.

Hi Big_buck,

I had a rule and removed it on Flo's advice and still see the extra stuff being dropped and nothing being passed.

I will recreate the rule and post the logs afterwards.

This might seem like a silly question, are all your devices built at the same time eg a new installation or an upgrade from older versions. During v17b testing there were different issues reported depending on new installation or upgrade and depended on what you upgraded from?

Ian

Pretty pictures.

Hey Big_Buck 

Could you PM me with your case number so that I can followup with what has been troubleshooted already?

Regards,

FloSupport | Community Support Engineer