This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Updgrade to 7.5 SNAT not working

Hi,

Since I upgrade to 7.5 (yesterday) I can't access the websites that are hosted internally.

The HTTP content filter lock shows the site being blocked as it is uncategorized, yet the policy allows traffic to uncategorized sites.

After a time, Astaro responds with "Connection to Server timed out", rather than giving the message that it was blocked as per a rule.

I'm suspecting this is a bug, as it was working fine in 7.4

JJ.

This thread was automatically locked due to age.

0 Micahsdad1402 over 16 years ago

Further to this. I added the url to the always allow list and still blocked it.

Message in the log:

2009:10:16-12:19:41 jericho httpproxy[13456]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.14.20" user="john" statuscode="502" cached="0" profile="REF_BUIAFZvJYH (Gold Rush Users)" filteraction="REF_ITyIZmkIHt (Gold Rush Filter)" size="2168" time="64581 ms" request="0xa7c084e8" url="www.cmaa.org.au/" exceptions="" error=""
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 16 years ago

Hi, can you check the proxy, IPS, and PacketFilter logs?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Micahsdad1402 over 16 years ago

IPS Log has the following:

2009:10:16-13:34:26 jericho snort[13558]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="LAND Attack, sameip detected" group="242" srcip="58.96.78.84" dstip="58.96.78.84" proto="6" srcport="80" dstport="40174" sid="200012" class="" priority="0" generator="1" msgid="0"
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago
Well, I think this is a new feature in V7.5. A lot of IPS rules have been changed and added, and it looks like you've run afoul of one. You can #1, disable the rule in IPS (less secure), or #2, delete your NAT rule and add a static entry in DNS (better).

Some thoughts if you select #2:
If the webserver is in a DMZ, you might need to add a packet filter rule to allow direct access to it if you aren't using the HTTP proxy.
https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/32566

Cheers - Bob
Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 utm_kid over 16 years ago in reply to BAlfson

Hi,

Can u please check this

https://community.sophos.com/products/unified-threat-management/astaroorg/f/98/t/68370

https://community.sophos.com/products/unified-threat-management/astaroorg/f/98/t/68378

r u using wan in bridge mode ?

can u please add 200012 to exeption to ips (network security>> Intrusion Prevention >>advanced -- Manual rule modification),r u getting LAND Attack, sameip detected error in ips ,i face this problem with DNAT in beta (ftp server)
can u please check u r wan bind to which interface (internal,wan,any ?)

Thanks
Cancel
Vote Up 0 Vote Down

Cancel