This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Able to View Port 80 Across VLANS - Not Sure Why

I was wondering if you guys could help me out on a little VLAN problem.

I set up VLANS on the UTM for the first time tonight. The config looks something like this:

ETH0 = WAN
ETH 1 = VLAN 10 (192.168.1.0 /24) and VLAN 20 (192.168.2.0 /24).

ETH 1 is connected to the switch on a Trunk port carrying 5U, 10T and 20T.

I have an AP50 running (on VLAN 10 for a connection to the UTM) as well. The AP50 (set to VLAN 10 in config) is plugged into another Trunk port on the switch that allows 5U, 10T and 20T to be carried on it. I am running a wireless network on the AP50 that puts clients onto VLAN 20.

Client 1 is connected to an Access port on the switch configured to VLAN 10 (untagged).

What I find interesting is that clients on VLAN 10 can access port 80 (and 8080?) of clients on VLAN 20 (in this case, IP cameras). However, software that connects to the RTSP port from VLAN 10 to VLAN 20 can't connect without a firewall rule.

I even tried creating a firewall rule to reject traffic from VLAN 10 to VLAN 20 on the UTM and it still passes through.

Is this a byproduct of webfiltering? Does it somehow trump firewall rules? I am very confused as to why two different subnets/VLANs can connect from one to the other on port 80.

I am relatively new to VLANs and maybe this is just a comprehension error on how they should behave.

This thread was automatically locked due to age.

0 Scott_Klassen over 10 years ago

Is this a byproduct of webfiltering? Does it somehow trump firewall rules?
Yes, it's due to the Web Filtering Proxy, but not a by-product, it's by design. The proxy creates hidden firewall rules that have precedence over manual rules. If you want to block these accesses, you'll need to block them in the applicable Filter Actions.

Anywhere in WebAdmin that you see an allowed networks/hosts box, it creates firewall rules to allow the accesses. Manually created firewall rules have the lowest precedence, below those created by country blocking, automatic NAT rules, proxies, and VPNs.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 check12 over 10 years ago

Thanks so much Scott. Your response is very much appreciated.

So in this scenario, how would one stop one VLAN from browsing another VLAN via port 80/8080? (i.e. they could still look at port 80 on the WAN - but port 80 to any other VLAN will no longer work). Sorry I am a little dense as I am brand new to the UTM.

Secondly, you will notice I am passing 5U (VLAN 5 untagged) to the UTM too. Is this worthless as the UTM only looks at tagged traffic? Should 5U actually be 5T? In the context of a Cisco switch, would a trunk port then tag all 5U as 5T so that the UTM can handle it?

Thanks again!
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

Check, if you're interested in a copy, I maintain a document "Configure HTTP Proxy for a Network of Guests - V9.3" that's available to fellow members here in English and German. Click on my username beside the Cyrano avatar to send me an email if you'd like a copy.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 check12 over 10 years ago in reply to BAlfson

Check, if you're interested in a copy, I maintain a document "Configure HTTP Proxy for a Network of Guests - V9.3" that's available to fellow members here in English and German. Click on my username beside the Cyrano avatar to send me an email if you'd like a copy.

Cheers - Bob

Thanks so much Bob! Looking into this now.
Cancel
Vote Up 0 Vote Down

Cancel

Able to View Port 80 Across VLANS - Not Sure Why

Submitted a Tech Support Case lately from the Support Portal?