This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall Confusion

Sophos Community,

Let me begin by saying that I can be very long winded and don't normally post in general so if this is in the wrong place on the forum or includes too much information please excuse me.

Let me begin with the "Long version" as it contains what I consider to be pertinant details about my network and situation. Please CTR+F to "Short Version" if you would like to see only my questions.

Long Version

I am new to Sophos but not new to networking or the search for an excellent offering as an open source or Home edition UTM. I have used Dansguardian, PFsense, ipcop, Mikrotik, Shade (what a joke), and Untangle. So far my favorite simply from ease of use is the Untangle software but it does not offer as much as the Mikrotik can if you know enough or that Sophos offers out of the box and espically if you consider its potential.

My network is as follows. I work for my ISP and we have fiber terminated at the office which then gets rebroadcasted via wireless to my home. From there the "modem" or "radio" which is completely bridged is plugged into the external interafce of my Sophos box which is an old repurposed Dell. I believe I bought it in '06 but that could be off, either way it has more than sufficent hardware to run just about any offering you can think of in this case and sports a 1TB drive. From there I have a secondary NIC that goes through standard ethernet to a Netgear EoP (Ethernet over Power, it uses the existing power lines in the home to bring the signal to its twin in another part of the house) Out of the second EoP it goes to standard ethernet to Eth1 on my RB2011UAS-2HnD-IN which currently only serves to wireless clients via its 1000mw radio card.

Through this setup I can pull my full speed that I get from the shop of 15Mbps at about any given time unless I enable download throttling or any QoS. My Mikrotik is completely bridged, the clients get DHCP form the Sophos UTM. 9.100-8 with an update pending.

To begin I have a few examples of issues that I struggled with handling with my Sophos setup.

1. Xbox Live

Like many home networks I have an Xbox360 and other gaming systems. So far I have only tried tackling the 360. As I am sure most of you are aware for optimum performance on the Xbox Live servers a few specific ports have to be open.

Port 88 (UDP)
Port 3074 (UDP and TCP)
Port 53 (UDP and TCP)
Port 80 (TCP)

Reference Here --
Xbox Network Ports | Xbox 360 Network Ports | Xbox LIVE Network Ports - Xbox.com

Initially after adding rules in my firewall I was not able to get the fabled "Open NAT". I even tried an Any to Any to Any rule as rule 1. (With which I was still dropping a ton of packets and not only on the aforementioned ports... I diasabled all of the other filtering services and still saw the same issue) It was only after finding another forum (or perhaps it was a post on this forum I forget) that showed me how to use the DNAT rules for NAT that I was able to make sure that the traffic was handled properly and allowed the ports to be opened up so that I could have Open NAT.

2. Ultrasurf

Let me begin by saing that I acknoledge the difficulties involved in blocking this program and other programs of this type. My main goal is to discourage use of this program entirely from the network level. I do not believe in the lost cause of blocking Untangle but that is not the reason for this post.

In an attempt to be brief I will boil this down some. Ultrasurf creates a proxy on the localhost using port 9666 which that traffic never sees the network level. From there using HTTPS it establishes a secure connection to one of its many IP's out of at least 2 known networks.

65.49.0.0/17
204.107.140.0/24

Reference Here --
How to Detect and Block UltraSurf program traffic - MikroTik Wiki

I defined both networks as Ultrasurf1 and Ultrasurf2 respectively. I would think that if I put in a rule that said Source: Ultrasurf1 using HTTPS (Or Any) going to Internal Network (or External IP) and visa versa that all traffic...at the very least on those networks...would be killed. Well I have 12 individual rules, one for each of the above going both ways and I can still go to What Is My IP

| Shows Your IP Address. while using Ultrasurf and be on the first network...it does not even stumble.

3. Web Filter

I blocked Uncatagorized web pages with the web filter and it blocked some local pages (to be expected) but when I added them to the Always Allow URL list they were still blocked....what gives?

Those are all of the Examples I have.

Short Version

Questions

1. How does NAT effect my firewall rules? Will I always have to change my NAT to make some rules work?

2. Is Sophos a Top Down filter? I had read that it was and it seems to be but I put in that Any to Any to Any rule as rule 1 and disabled all of the other services and still had no Open NAT and was dropping packets left and right (on the Firewall Open Log).

3. Is the Firewall broken or am I missing something? If I make a rule that says no traffic allowed from this source network or to this source network using any service to both the Local Network and the External IP, how in the nine hells is it still going?

4. Do grouped rules work well? Again my understanding fo the firewall is that the first rule that matches is the rule that is used in a top down order. So can I group source and destination and services together to eliminate multiple rules where 1 or 2 would work just as well or is there a good reason to split them up? Will using more rules slow down the Filter?

5. What is the color coding for? I can't find any documentation for this. I assume it is to tell the administrator "used", "being used", "never used", or other things like that to tell the admin how effective the rules are.

**Nevermind this is to show groups, I did some more digging**

6. I have what I consider to be some pretty strict settings against people who would try and get around the filter which is currently my main focus.
Anonymizers
Anonymizing Utilities
Are both being blocked by the Web Filter, all VPN, P2P, and Proxy services are blocked in the Application filter, and I have a few generic rules in my firewall to prevent Ultrasurf at the moment. And I have succeeded in blocking programs like ProXPN (a VPN tunneler to anonymize traffic) with Sophos but for me if you can do a 5 Min Google search, find Ultrasurf, and dodge the filtering, then all of that work is for nill. So my question, What more can I do? Is there a way to do MIME types or Add signatures for application (layer 7) filtering? As I understand it Smoothwall and SonicWall and other solutions block it pretty easily yet I can find no documentation or manage it myself.

Well I have more questions but I had better call it a day. Sorry if there are any spelling or grammical errors, I typed this up once already but tried to submit it and got an Authentication Ticket invalid or some crap and had to retype it all again....

Thanks for anyone who took the time to read this and double thanks if you respond with advise!

Bergie

This thread was automatically locked due to age.

Parents

0 BAlfson over 12 years ago

So in regards to the packet rule, what you are saying is that since the UTM sees the traffic coming from the localhost proxy on the client PC that it is handled as a proxy without consideration to the firewall.

Yes, the "invisible" Firewall rules for the HTTP Proxy are applied before your manually created rules.

I do have everything associated with this blocked in the Web Filter (although I did not use the default "IT" definition, I made a new one for the specific ones I wanted for this) and also everything in the Application filter...are those taken into consideration? I mean they are supposed to attempt to block VPN's and Proxies as well.

In "Transparent" mode, only port 80 is controlled unless you select to scan SSL.  The easier solution is to not allow 'Internal (Network) -> Web Surfing -> Internet' traffic and to use the techniques in the document - I'll email it to you - send an email to my username here @ the domain name in my signature.

Since DNAT rules are handled first (I have tried these but neglected to mention) would a DNAT or SNAT of say anything coming from Ultrasurf1 or Ultrasurf2 using HTTPS and going to Internal Network or External WAN IP gets redirected as a differrent service or somehow redirected to perhaps an IP that does not actually exist on the network in an effort to "drop" the traffic so that Ultrasurf does not recognize a reject and try more options?

This can work, but Ultrasurf is just one of many.  The trick to this technique is the service definition: "HTTPS" is "1:65535->443" so "HTTPS-Response" is "443->1:65535". Oops!  See post # 13 below.

Also just for laughs when I made that rule I blocked myself out of Sophos and ended up reformatting. I now have a top rule of allow  using HTTPS to

You probably had an "Any" rule.  I prefer to not use Drop rules.  The UTM blocks all traffic that is not explicitly allowed.  You really only needed to disable the 'Allow : Internal (Network) -> Web Surfing -> Internet' rule that was created by the Installation Wizard when you installed.

I will look into what you recommended about the UTM. Is there a forum specifying what needs to be done? Currently my NIC's are not capable of utilizing the "full bridge mode" apparently although I did not know that was something that was an "extra".

There are no extras for the home-use license - all of the capabilities are included except for some cosmetics.  I never recommend running the UTM in bridge mode - it's always preferable to have a public IP on the External interface.

Is their no way to view a "master live log" that shows what traffic is hitting what services? Like one log with 4-5 colums so you can view them all at the same time to determine where you may need to effect changes?

You could run tcpdump at the command line.

what if I changed the service that was going across the NAT with an SNAT and DNAT rule that changed it from HTTPS to HTTP? Would that make it scan-able or cause Ultrasurf to lose its encrypted connection and terminate to its servers?

HTTPS traffic is encrypted between the client and server, so that would block the traffic, but it's not a good solution.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 12 years ago

So in regards to the packet rule, what you are saying is that since the UTM sees the traffic coming from the localhost proxy on the client PC that it is handled as a proxy without consideration to the firewall.

Yes, the "invisible" Firewall rules for the HTTP Proxy are applied before your manually created rules.

I do have everything associated with this blocked in the Web Filter (although I did not use the default "IT" definition, I made a new one for the specific ones I wanted for this) and also everything in the Application filter...are those taken into consideration? I mean they are supposed to attempt to block VPN's and Proxies as well.

In "Transparent" mode, only port 80 is controlled unless you select to scan SSL.  The easier solution is to not allow 'Internal (Network) -> Web Surfing -> Internet' traffic and to use the techniques in the document - I'll email it to you - send an email to my username here @ the domain name in my signature.

Since DNAT rules are handled first (I have tried these but neglected to mention) would a DNAT or SNAT of say anything coming from Ultrasurf1 or Ultrasurf2 using HTTPS and going to Internal Network or External WAN IP gets redirected as a differrent service or somehow redirected to perhaps an IP that does not actually exist on the network in an effort to "drop" the traffic so that Ultrasurf does not recognize a reject and try more options?

This can work, but Ultrasurf is just one of many.  The trick to this technique is the service definition: "HTTPS" is "1:65535->443" so "HTTPS-Response" is "443->1:65535". Oops!  See post # 13 below.

Also just for laughs when I made that rule I blocked myself out of Sophos and ended up reformatting. I now have a top rule of allow  using HTTPS to

You probably had an "Any" rule.  I prefer to not use Drop rules.  The UTM blocks all traffic that is not explicitly allowed.  You really only needed to disable the 'Allow : Internal (Network) -> Web Surfing -> Internet' rule that was created by the Installation Wizard when you installed.

I will look into what you recommended about the UTM. Is there a forum specifying what needs to be done? Currently my NIC's are not capable of utilizing the "full bridge mode" apparently although I did not know that was something that was an "extra".

There are no extras for the home-use license - all of the capabilities are included except for some cosmetics.  I never recommend running the UTM in bridge mode - it's always preferable to have a public IP on the External interface.

Is their no way to view a "master live log" that shows what traffic is hitting what services? Like one log with 4-5 colums so you can view them all at the same time to determine where you may need to effect changes?

You could run tcpdump at the command line.

what if I changed the service that was going across the NAT with an SNAT and DNAT rule that changed it from HTTPS to HTTP? Would that make it scan-able or cause Ultrasurf to lose its encrypted connection and terminate to its servers?

HTTPS traffic is encrypted between the client and server, so that would block the traffic, but it's not a good solution.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Bergie008 over 12 years ago in reply to BAlfson

Forgive me, another long post. I am responding to both Stealthmatt and BAlfson. Thank you both for taking your time to help me.

Stealthmatt

In order for web filtering + transparent proxy you need to enable HTTPS scanning.

I do have my UTM in Transparent mode right now. The three modes as I understand it are Standard, Transparent, and "Full Transparent" or "Bridged" modes. BAlfson has recommend against Full transparent so that the UTM gets the "real world" IP on its external interface which I would have to agree with.

Is there anywhere with good documentation on what Standard Mode does vs. Transparent? I think I fully comprehend "Full Transparent" but would still like to read up on it as well.

That being said are you saying the reason I was unable to use full transparent mode was because I did not have HTTPS scanning enabled? I don't remember if I did or not...I play with the option quite often simply for the fact that since everyone knows secure traffic is very difficult to filter its also the best way to circumvent said filter and if I can get it to work I want it on.

NAT allows forwarding of an external port(connection) to connect to an internal client/device. Basically NAT rules are like port forwording.

I understand the basics of NAT for the most part, or at least like to think I do, my confusion was born from never having NAT rules and firewall rules so closely linked, normally I just place the firewall rules in and boom done. (until now my Mikrotik has always done the routing/NAT even with Sophos or another UTM had the gateway and ISP provided IP.
Perhaps its more preferable to let my Mikrotik NAT its clients and give only one IP to Sophos to take care of, I will lose some functionality on the NAT but hopefully I can make up with it using the Mikrotik's powerful configuration to make NAT rules in it like I would in Sophos...then I don't have to worry about it for the firewall? Just a thought.

How are you determining this? If it is by a ping or tracert command chances are you have allowed for ICMP packets to transverse and default built in firewall rules are higher on the list than custom rules. Disable your ping/icmp packets and have a check then.

ICMP is blocked on both interfaces of my UTM. I was determining this by going to What Is My IP ® | Shows Your IP Address. while using Ultrasurf from the internal network. I think we have narrowed it down to the fact that either because i'm not scanning HTTPS the firewall rules are not being used because the traffic does not make it to the firewall or as it is proxy traffic...even though its a local proxy.... its hitting the "invisible" firewall rules first and not mine that I set.

I fully understand Ultrasurf is not the only threat out there for users to bypass my filter. I have mentioned a VPN type threat called ProXPN that Sophos has successfully neutralized, with out of the box settings that I merely enabled. I also understand that no firewall is impenetrable. But just as there are differing degrees in bulletproof armor so do I want the best for my filter. If I can make it better why should I not strive to do so?

My benchmark for this is if I can spend 5 min Googling how to get around it and do it within that timeframe then I have not been successful. Maybe i'm naive but I want an enterprise ... "barracuda" solution as that is almost what is required to discourage misuse of the network. Even then I can't control mobile networks, but at least at that point its not on my tab.

make sure HTTPS scanning is enable... you must have this if your using transparent proxy. Also check to make sure your any to any rule is still not enabled as this will cause issues with blocking ports as its allowing full access.

As I understand it if I enable HTTPS scanning I am basically effectively blocking all HTTPS sites for my network because modern browsers will not accept the new certificate. Correct me if I'm wrong but I can upload my own certificate but even in a best case scenario the user will still have to acknowledge that its not the original and possibly not trusted. That's not an insurmountable obstacle but I would prefer an alternative if one exists.

If you want me to take a look at your config/etc id be more than happy to remote in or use teamviewer to have a look and see what might be up...

Perhaps at some point I will let you take a look at my config if we can not get it figured out through our discussion but please do not take offense when I state that I am loathe to use that option unless I have exhausted all others. Also I would prob go with a join.me session paired with some sort of IM so that I could retain control while receiving assistance. Call me over parionied but some days I just watch my firewall live log and watch my PC request and receive traffic (albeit dropped traffic) that is going all over the world, and i'm about 80% confident its not from anything I installed or asked for!

Perhaps if there is a way to export it to you and I can edit the IP ranges of my network I would find that acceptable and you might find it enlightening?

BAlfson

Yes, the "invisible" Firewall rules for the HTTP Proxy are applied before your manually created rules.

Is their any record or way of knowing the Invisible rules?

In "Transparent" mode, only port 80 is controlled unless you select to scan SSL. The easier solution is to not allow 'Internal (Network) -> Web Surfing -> Internet' traffic and to use the techniques in the document - I'll email it to you - send an email to my username here @ the domain name in my signature.

E-mail will be sent after this message, thanks for the help.

This can work, but Ultrasurf is just one of many. The trick to this technique is the service definition: "HTTPS" is "1:65535->443" so "HTTPS-Response" is "443->1:65535". Oops! See post #13 below.

Simple when you think about it, i'll have to review and possibly revise my DNAT and SNAT rules.

You probably had an "Any" rule. I prefer to not use Drop rules. The UTM blocks all traffic that is not explicitly allowed. You really only needed to disable the 'Allow : Internal (Network) -> Web Surfing -> Internet' rule that was created by the Installation Wizard when you installed.

Until I know that I have allowed all traffic that I wish with the firewall I will not disable the wizard created all rules so as to have functional internet for my wife who is at home. She already gets frustrated with the nightly changes, and as a result the occasional unexpected false positive even though realistically they are few and far between. She is a tad spoiled [:)]

There are no extras for the home-use license - all of the capabilities are included except for some cosmetics. I never recommend running the UTM in bridge mode - it's always preferable to have a public IP on the External interface.

That was poorly worded by me. I meant Sophos acted as if it was a limitation from the hardware and I was not aware it was a feature that was optional on NIC's, I thought it has been integrated for some years now.

I understand the following question can be a bombshell but I would like to know anyways. The simplest answer or some documentation would possibly be the best way to help me here. I have not really researched it either so perhaps I need to get on that. But what is the main difference between TCP and UDP? I understand they are different (packet or port?) protocols...do they make headers look totally different or are they simply labeled differently? Is one more "dangerous" than the other? Would a tcpdump ignore all UDP stuff (like it sounds) and is that something that I should be worried about?

HTTPS traffic is encrypted between the client and server, so that would block the traffic, but it's not a good solution.

I prefer elegant when possible but like MacGyver I am not afraid to use what is available.

I can't think of any NEW questions other than the ones born from talking but I assure you I am bristiling with them. I am just trying to contain relevent ones to this one thread if possible. Again I cannot thank you enough for your assistance and expertise.

Best Regards,

Bergie
Cancel
Vote Up 0 Vote Down

Cancel