Guest network access. Packetfilter does not block as expected

i think you describe your problem:

"Our HTTP proxy runs in transparent mode. Guest network is set to skip source mode. Allow HTTP/S for skipped networks is enabled! (Due to requirements for some internal networks)"

just for testing disallow http/s traffic for skipped networks in the http proxy.

can guest network now still reach internal websites?

Hello

sorry for the late reply.

I tested disabling HTTP/S access for skipped host/nets

Same issue. Access to the internal sites is still possible

Best regards

please test following:

split your first firewall rule in 3 single rules.. one rule for one network.

put the guest to internal drop first and select log traffic in this rule.

open paket filter log and test again.. what do you see?

EDIT:

please also check if you have more than one webfilter profile which maybe matches your guestnetwork...

Ingo, I think I'm following you - I would do this differently.

1. Remove the Guest network from 'Skip Transparent Mode Source ...'
2. Put your LANs in 'Skip Transparent Mode Destination ...'
3. De-select 'Allow HTTP/S traffic for listed hosts/nets'
4. Make explicit firewall rules that allow traffic between, for example, "Internal (Network)" and "DMZ (Network)"

Since there's no rule allowing "Guest (Network)" to go anywhere but the Internet, you should see that traffic to your LANs default dropped in the Firewall Live Log.

Cheers - Bob 

Ingo, I think I'm following you - I would do this differently.

1. Remove the Guest network from 'Skip Transparent Mode Source ...'
2. Put your LANs in 'Skip Transparent Mode Destination ...'
3. De-select 'Allow HTTP/S traffic for listed hosts/nets'
4. Make explicit firewall rules that allow traffic between, for example, "Internal (Network)" and "DMZ (Network)"

Since there's no rule allowing "Guest (Network)" to go anywhere but the Internet, you should see that traffic to your LANs default dropped in the Firewall Live Log.

Cheers - Bob 

Hello Balfson,

thanks a lot. This solved the issue.

Yet again this is an issue related to (me and maybe others having) lack of insight into the processing order and its implications.

I always assumed the packet filter would match first and pass stuff.

In my opinion Sophos should release an official flow-chart on this topic (and not only as part of the training-material for official certifications) to allow admins to see what is going on and therefore ease the process of debugging

Best regards to BAlfson and Zaphod for your help :) Appreciated

Ingo, see #2 in Rulz.  I got the diagram from Astaro in the pre-Sophos days. [;)]

Cheers - Bob