This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't connect to any HTTPS site - 7.504

Hi,
I recently downloaded and configured an Astaro firewall. I can't get it to allow access to https. I have Web Security enabled using Transparent mode (not full) and a rule allowing out going access for the web surfing service. While watching the logs I see entries for regular websites which work fine such as yahoo or msn, but I do not see an entries for the https sites such as mail.yahoo.com. I wonder where is the traffic was going if not through the Astaro. Thank you in advance.

Ryan

This thread was automatically locked due to age.

0 William Warren over 16 years ago

You have to either enable https scanning(with the related certificate headaches) or put in a packet filter rule allowing https. I would recommend the latter over the former.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 mynameisRyan over 16 years ago in reply to William Warren

The web services include http and https so both should be allowed. I tried creating two rules, one for http and one for https but no luck.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 16 years ago

exactly how do you have the packet filter setup?

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 mynameisRyan over 16 years ago in reply to William Warren

Group: Out Going
Position: 1
Source: 192.168.100.1 (Network)
Service: Web Surfing
Destination: Any
Action: Allow
Time Event: Always
Log traffic: checked

I have two groups, Out Going and In Coming. You can tell the inside IP is 192.168.100.1 which is the gateway of the PCs behind the Astaro. The Web Surfing service includes http, http proxy, http webCache and https.

Do you see anything wrong?
Thanks,
Ryan
Cancel
Vote Up 0 Vote Down

Cancel
0 mynameisRyan over 16 years ago in reply to mynameisRyan

For Web Security I have the following.

HTTP Proxy Status: enabled
Allowed Networks: 192.168.100.1 (Network)
Scan HTTPS (SSL) Traffic: not checked
Operation mode: Transparent
Full transparent mode: not checked
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 16 years ago

yeah you have to specify the source as being internet not local. right now you allow outbound https but not inbound.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 mynameisRyan over 16 years ago

This maybe a stupid question. Why do I need to allow inbound if users will be surfing the network. I'm not hosting a website with http or https.

Thanks,
Ryan
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 16 years ago

if you don't alow https inbound you won't be able to get the return traffic. The web proxy automatically makes the appropriate adjustements for http..but it does NOT for https. You have to manually allow https outgoing AND allow the https return traffic as well.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 dilandau over 16 years ago

I think you need to add a NAT MASQ rule, if you want to allow the https traffic via the packet filter.
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 16 years ago in reply to dilandau

Make sure you create a masquerade rule. Its under NAT.
Masq
Network --> 192.168.100.1 (Network)

Use Interface -->External
and that should fix your problem.
Cancel
Vote Up 0 Vote Down

Cancel