Unable to connect to internal web servers through web proxy

Question

Whenever an internal client device tries to access one of our internally hosted public web servers, the page is blocked by the UTM Firewall with the following message:

08:21:40 
 WebAdmin connection attempt 
 HTTP

*.*.*.120 
 : 
 46760

&rarr;

*.*.*.120 
 : 
 443

[SYN] 
 len=60 
 ttl=64 
 tos=0x00 
 srcmac=00:00:00:00:00:00

*.*.*.120 in the logs is the public IP address of the web server being accessed. 
 
 The "WebAdmin connection attempt" error is particularly weird, because our WebAdmin console is not available on that interface, IP, or port. 
 Clients on the Internet, from outside of our network, are able to access the sites successfully. It is only clients using the UTM proxy being blocked. 
 We are using 3 Sophos UTM components: 
 1. Web Filter - Our clients all access the internet through the Sophos proxy server in Standard mode. 
 2. Firewall - All of our global IPs are on Sophos UTM Interfaces protected by the firewall. 
 3. Web Application Firewall - Our publicly hosted web servers are configured behind this. 
 
 Sophos support told me to use the browser settings to proxy bypass. This doesn't work, and frankly doesn't make any sense to me as a solution. The client would still be routed in and out of the same interfaces regardless. 
 One potential solution is split DNS. Unfortunately the internal web server is on a non-standard port, so this is less than ideal for our clients. 
 Any assistance would be very appreciated! I've seen this sort of problem posted many times on the Sophos forums, but haven't found any posts with a solution.

Derek Preston · Answer

We ran into the same exact issue. Please check to see if your User Portal is listening over port 443. If it is, try changing it to 4443, etc. 
 Appears to be a bug with UTM. We have an External interface (ETH1) with additional addresses associated to it. Our User Portal listens over 443 on the primary External interface's public IP. Our Virtual Web Servers listen over 443 on their corresponding additional addresses associated to the same External ETH1 adapter. 
 For whatever reason, all clients going through the Web Proxy could not connect to the Virtual Web Servers over 443, but instead tried connecting to the User Portal's 443, which would generate the "WebAdmin connection attempt" error. 
 On the other hand, clients that bypass the Web Proxy entirely (not via Web Proxy Filter exceptions) had no issues accessing the Virtual Web Servers.