It would be nice to show the hosts in the "automatic firewall rules" filter
which are allowed at the Web Protection > Web Filtering > Advanced > Transparent Mode Skiplist.
It is a main configuration error and then troubleshooting part why hosts can surf to the internet
although there is no packetfilter rule allowing this.
Regards,
Marco