This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocked site error="Connection to server timed out"

Hi!

I have an Astaro as a transparent proxy bridge.

I can browse all sites besides ****o (blocked by me) and Yandex Maps:
??????.?????

Error in log:

2010:08:10-12:55:31 Astaro httpproxy[4716]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.1.2.110" dstip="93.158.134.106" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="4938" time="63373 ms" request="0xee64a6a0" url="api-maps.yandex.ru/.../

After that I've add all Yandex sites in:
Web Securiti - HTTP/S - URL Filtering - Always allow thi URLs/sites

Nothing happens

I've add Yandex to Exceptions Skipping: Authentication / Caching / Antivirus / Extension blocking / MIME type blocking / URL Filter / Content Removal / SSL scanning / Certificate Trust Check / Certificate Date Check to yandex.ru and yandex.st

Nothing.

I've add PF rule to pass all traffic from LAN to 93.158.134.106 - Nothing again
[:(]

Now logs looking like this:

2010:08:10-13:36:31 Astaro httpproxy[4716]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.1.2.110" dstip="93.158.134.106" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="4938" time="60723 ms" request="0xe3b13a98" url="api-maps.yandex.ru/.../

How can I solve this?

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

Astaro version - 8.0

Hmm, in that case, try: https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/44620

Look at the HTTP log, the Packet Filter Log and the Intrusion Prevention log.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

0 kapa over 15 years ago in reply to BAlfson

Look at the HTTP log, the Packet Filter Log and the Intrusion Prevention log.

Cheers - Bob

Thank you, Bob!

I've found that it was snort!


2010:08:10-18:59:37 Astaro snort[5085]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-MISC encoded cross site scripting HTML Image tag attempt" group="211" srcip="10.1.2.110" dstip="93.158.134.106" proto="6" srcport="48846" dstport="80" sid="10990" class="Web Application Attack" priority="1" generator="1" msgid="0"

2010:08:10-18:59:48 Astaro snort[5085]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-MISC encoded cross site scripting HTML Image tag attempt" group="211" srcip="10.1.2.110" dstip="93.158.134.106" proto="6" srcport="48854" dstport="80" sid="10990" class="Web Application Attack" priority="1" generator="1" msgid="0"

2010:08:10-18:59:53 Astaro snort[5085]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-MISC encoded cross site scripting HTML Image tag attempt" group="211" srcip="10.1.2.110" dstip="93.158.134.106" proto="6" srcport="48859" dstport="80" sid="10990" class="Web Application Attack" priority="1" generator="1" msgid="0"

After adding yandex.ru to the Exceptions of IPS all works fine!

Reply

0 kapa over 15 years ago in reply to BAlfson

Look at the HTTP log, the Packet Filter Log and the Intrusion Prevention log.

Cheers - Bob

Thank you, Bob!

I've found that it was snort!


2010:08:10-18:59:37 Astaro snort[5085]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-MISC encoded cross site scripting HTML Image tag attempt" group="211" srcip="10.1.2.110" dstip="93.158.134.106" proto="6" srcport="48846" dstport="80" sid="10990" class="Web Application Attack" priority="1" generator="1" msgid="0"

2010:08:10-18:59:48 Astaro snort[5085]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-MISC encoded cross site scripting HTML Image tag attempt" group="211" srcip="10.1.2.110" dstip="93.158.134.106" proto="6" srcport="48854" dstport="80" sid="10990" class="Web Application Attack" priority="1" generator="1" msgid="0"

2010:08:10-18:59:53 Astaro snort[5085]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="WEB-MISC encoded cross site scripting HTML Image tag attempt" group="211" srcip="10.1.2.110" dstip="93.158.134.106" proto="6" srcport="48859" dstport="80" sid="10990" class="Web Application Attack" priority="1" generator="1" msgid="0"

After adding yandex.ru to the Exceptions of IPS all works fine!

Children

No Data