Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 13 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 3273 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Default Drop in Forward Chain

Ryan Miller2

We use the 8x8 Work Desktop application. The app employs WebRTC and I'm getting a few hundred thousand default drops for UDP packets going to 8x8 turn servers every 24 hours. The turn server IP addresses (all 8x8 IP addresses for that matter) are in the proxy skip list and have an IPS exception. I can't figure out where this drop is in the forward chain. The proxy is in transparent mode with the allow HTTP/S box checked. QoS is not applied to turn server traffic. The drop is happening for port 80 and 443.

Firmware version: 9.705-3

id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="eth2" srcmac="<redacted>" dstmac="<redacted>" srcip="192.168.xxx.xxx" dstip="129.159.81.24" proto="17" length="48" tos="0x00" prec="0x00" ttl="127" srcport="59581" dstport="443"

The firewall rule this is firing on is LAN1 -> <port allow list> -> intv4/intv6



This thread was automatically locked due to age.

Top Replies

  • in reply to Ryan Miller2 +1

    Your firewall rule doesn't have the HTTPS service, Ryan  Although your current problem will be fixed by adding HTTPS, I would suggest you also change your Web Filtering configuration...

    'URL filtering only' on the 'HTTPS' tab means that only the very first connection of a user to a site with HTTPS goes through the web proxy.  After that, there's no control and no protection.   Best practice is 'Decrypt and scan'.  Doug Foster's excellent Securing and Configuring Web Filtering is a good place to get an overall understanding.  To avoid disruption, you will want to create a "Test" Web Filtering Profile with just your PC's IP in 'Allowed Networks' so that you can see what additional Exceptions and 'Transparent Mode Skiplist' entries you might need.

    Cheers - Bob

    Jump to answer