Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 1 subscriber
  • Views 638 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[7.405] Possible bug in HTTP-proxy

lejzer
Hi, 

I've noticed a strange thing today. First our setup:

ASG 7.405 with lots of VLANs and transparent HTTP proxy. 

In our place we have many different companies accessing internet behind our ASG. I've configured every company on different LANs using VLANS. 

Now i've discovered that every company that uses our http-proxy can access any of the other VLANs printers (webinterface) on the different VLANS, even though i've setup rules like this:

LAN2 > service: any > LAN1- drop/reject

Example:

LAN1: 192.168.2.x
LAN2: 192.168.10.x
LAN1 printer: 192.168.2.114

Users on LAN2: can browse to http://192.168.2.*** and access the webinterface of the printer. This shouldn't be working since i have PF-rules denying access. Somehow the proxy seem to override these rules

But, if i remove the company's LAN from the proxy, and add HTTP as a packetfilter rule, then they can't access our printers webinterface.

So, what's the deal here? Why is the proxy overriding these rules making it insecure?

Any ideas?

Thank you


This thread was automatically locked due to age.
Parents
  • 0
    Great idea, dilandau!  That would let him leave all customers in transparent mode.  The only downside is that he would need to put in a lot of individual addresses unless his customers are organized enough to structure their networks logically.

    Yeah, that's such a simple solution and so obvious once you mention it.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    Great idea, dilandau!  That would let him leave all customers in transparent mode.  The only downside is that he would need to put in a lot of individual addresses unless his customers are organized enough to structure their networks logically.

    Yeah, that's such a simple solution and so obvious once you mention it.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data