Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 4 subscribers
  • Views 7154 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

firewall / web filter question

Mike Bradshaw

I'm a bit of a noob running the home based utm, and, having read 'the rulz" I've been trying to grapple with firewall vs web protection.

I thought I had my head around it, but can not get a particular set to work.

I have a machine on my network which uses openvpn over both https (TCP) and standard openvpn port 1194 (UDP). I also wanted to restict access from this machine to certain ip destinations.

my soultion was...

Under 'web protection' I created a 'web filter profile' giving access to this one machine under 'allowed networks' and created a 'policy' to go with this.
The policy blocked everything under the 'catagories' section, and I put my allowed ip list in the 'website' tab under 'allow these websites', and blocked all 'http://' sites with a regular expresion of " ^http://* " in 'block these websites'

so far so good.

In the 'filtering options', 'misc' tab, I tried to drag the openvpn service across to the 'allowed target services' window, but it wouldn't let me.
I believe this is because the openvpn service use UDP as the transport layer. I created a new service 'myopenvpn' using TCP/UDP for port 1194 and dragged that to the 'allowed target serices' window. Success.

For log purposes, I created a firewall rule dropping everything from this one machine going to the internet.

Results in testing were mixed.

Everything worked well with openvpn over https. However, it would appear that when using port 1194, it does not go through the web filter (not in the logs) and as a result gets blocked by the firewall rule (in the log as blocked as expected)

Is this because the web filter does not process UDP packets, and only TCP ones, or have i missed something?

Thanks
Mike



This thread was automatically locked due to age.
Parents
  • 0

    Hi, Mike, and welcome to the UTM Community!

    You should follow Kevin's prescription.  You still need more study to understand how Web Filtering works.

    In Transparent mode, use the Transparent mode Skiplist to skip the Proxy for a particular source or destination.  Only HTTP and HTTPS can be handled in Transparent mode.

    'Allowed Target Services' applies only when your browser is configured to use Web Filtering in Standard mode.  Skipping the Proxy in Standard is done in Proxy Settings in your browser as the 'Transparent mode skiplist' does not apply to Standard mode accesses.

    If you select 'Automatically detect settings' in 'LAN Settings' in your browser, it's likely that your browser will "see" the Proxy and interact with it in Standard mode.  Even if you have only a Transparent mode Profile in Web Filtering, the UTM will accept the port 8080 traffic and apply the settings ('Allowed Target Services', blocks, etc.) as if it were in Standard mode.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    Hi, Mike, and welcome to the UTM Community!

    You should follow Kevin's prescription.  You still need more study to understand how Web Filtering works.

    In Transparent mode, use the Transparent mode Skiplist to skip the Proxy for a particular source or destination.  Only HTTP and HTTPS can be handled in Transparent mode.

    'Allowed Target Services' applies only when your browser is configured to use Web Filtering in Standard mode.  Skipping the Proxy in Standard is done in Proxy Settings in your browser as the 'Transparent mode skiplist' does not apply to Standard mode accesses.

    If you select 'Automatically detect settings' in 'LAN Settings' in your browser, it's likely that your browser will "see" the Proxy and interact with it in Standard mode.  Even if you have only a Transparent mode Profile in Web Filtering, the UTM will accept the port 8080 traffic and apply the settings ('Allowed Target Services', blocks, etc.) as if it were in Standard mode.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson

    Many thanks for the reply's.

    I wasn't aware that only HTTP and HTTPS were handled in transparent mode ( I don't recall seeing that in the online help / documentation) and thought that all the items in 'allowed target services' were handled.

    That explains why it my settings didn't work as expected. But now I know, at least I can just play around with various settings and learn what they do.

     

    Thanks again

    Mike

Unfiltered HTML