Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 2 subscribers
  • Views 2380 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Country Blocking]Exceptions not working

FrankBarmentlo
So, I decided to activate Country Blocking, and selected some countries to block  traffic.
Now I tried to make an exception, because I want to use bittorrent normally, without being affected by it.

So, I also made an exception.
Skip blocking of these:

For all request 
192.168.5.0/24
192.168.4.0/24
Using these:
Bittorrent_LT - out: 65527  -> 1:65535, protocol TCP/UDP
Bittorrent_Svr - out: 65533  -> 1:65535, protocol TCP/UDP

Yet, a lot of traffic is dropped coming from 192.168.5.3:65533
2015:01:16-20:12:36 vUTM-Frank ulogd[6723]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth3" outitf="eth0" srcmac="d0:50:99:30:a6:7a" dstmac="00:15:5d:02:ff:05" srcip="192.168.5.3" dstip="46.63.212.70" proto="17" length="129" tos="0x00" prec="0x00" ttl="127" srcport="65533" dstport="59018" 
2015:01:16-20:12:37 vUTM-Frank ulogd[6723]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth3" outitf="eth0" srcmac="d0:50:99:30:a6:7a" dstmac="00:15:5d:02:ff:05" srcip="192.168.5.3" dstip="121.54.54.173" proto="17" length="48" tos="0x00" prec="0x00" ttl="127" srcport="65533" dstport="2924" 
2015:01:16-20:12:37 vUTM-Frank ulogd[6723]: id="2003" severity="info" sys="SecureNet" sub="packetfilter" name="Packet rejected" action="reject" fwrule="28" initf="eth3" outitf="eth0" srcmac="d0:50:99:30:a6:7a" dstmac="00:15:5d:02:ff:05" srcip="192.168.5.3" dstip="187.102.173.210" proto="6" length="52" tos="0x02" prec="0x00" ttl="127" srcport="59325" dstport="34403" tcpflags="SYN" 
2015:01:16-20:12:38 vUTM-Frank ulogd[6723]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth3" outitf="eth0" srcmac="d0:50:99:30:a6:7a" dstmac="00:15:5d:02:ff:05" srcip="192.168.5.3" dstip="92.112.161.149" proto="17" length="129" tos="0x00" prec="0x00" ttl="127" srcport="65533" dstport="32786" 
2015:01:16-20:12:38 vUTM-Frank ulogd[6723]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="4c:ac:0a:12:14:4c" dstmac="00:15:5d:02:ff:02" srcip="176.33.175.11" dstip="192.168.2.248" proto="17" length="1451" tos="0x00" prec="0x00" ttl="109" srcport="12746" dstport="65533" 
2015:01:16-20:12:38 vUTM-Frank ulogd[6723]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth3" outitf="eth0" srcmac="d0:50:99:30:a6:7a" dstmac="00:15:5d:02:ff:05" srcip="192.168.5.3" dstip="213.87.131.176" proto="17" length="129" tos="0x00" prec="0x00" ttl="127" srcport="65533" dstport="21025" 
2015:01:16-20:12:41 vUTM-Frank ulogd[6723]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth3" outitf="eth0" srcmac="d0:50:99:30:a6:7a" dstmac="00:15:5d:02:ff:05" srcip="192.168.5.3" dstip="121.54.54.173" proto="6" length="52" tos="0x02" prec="0x00" ttl="127" srcport="59327" dstport="2924" tcpflags="SYN" 


I googled around and found that it was not working in 9.1, and got fixed in 9.2
So I expected it to work in 9.3, but I guess not?


This thread was automatically locked due to age.
Parents
  • 0
    Yes, I think this is another of the anomalies created when Heartbleed and Poodle struck so close together, revealing the fact that Sophos had no plans for the arrival of a Black Swan. 

    Cheers - Bob

    Sorry for any short responses.  Posted from my iPhone.
Reply
  • 0
    Yes, I think this is another of the anomalies created when Heartbleed and Poodle struck so close together, revealing the fact that Sophos had no plans for the arrival of a Black Swan. 

    Cheers - Bob

    Sorry for any short responses.  Posted from my iPhone.
Children
No Data