Are logged invalid packets allowed or rejected?

Here is what I found in tcpdump:

18:10:28.899478 IP withings.49154 > 89.30.121.150.https: Flags [P.], seq 3242:3823, ack 3649, win 6523, length 581
18:10:58.946484 IP 89.30.121.150 > withings: ICMP ip reassembly time exceeded, length 556
18:11:03.955797 ARP, Request who-has withings tell utm, length 28
18:11:03.971558 ARP, Reply withings is-at 00:24:e4:12:af:c6 (oui Unknown), length 46

and it loops endlessly...

withings is the same 192.168.1.85 ip as above

Rule 0 is a little strange because internal rules even at the top of the tree have a 600x number.

You will need the following rule to allow a basic internet connection

internal network -> any protocol (port) -> any (which is a generic term for the anybody outside of your UTM) -> allow -> log

MASQ internal network ->external interface.

With that rule you should see all traffic logged good bad or indifferent. If packets are dropped it usually means there is no identifiable connection the router (UTM) to associate them to.

This can be caused by different device responding to your original request which means you will need more complex rules and NAT setups.

Rule 0 is a little strange because internal rules even at the top of the tree have a 600x number.

You will need the following rule to allow a basic internet connection

internal network -> any protocol (port) -> any (which is a generic term for the anybody outside of your UTM) -> allow -> log

MASQ internal network ->external interface.

With that rule you should see all traffic logged good bad or indifferent. If packets are dropped it usually means there is no identifiable connection the router (UTM) to associate them to.

This can be caused by different device responding to your original request which means you will need more complex rules and NAT setups.

Here are rules I have. I thought that with these rules I should allow all traffic from Wifi Scale (withings) to Withings server (withings-srv)

I have connected Wifi Scale to 4G router, and it works fine... so there is issue with UTM. I have no idea how to disable any protection to those ip addresses...

Is the server internal? If it is you will dnat rules to allow for incoming traffic.

You are comparing a toy router with a seious firewall security device. By default all traffic is blocked and you need to make rules to allow the traffic to flow.

Hi Rock Road,

I've same issues at some of my customers and have created a support case. Sophos said, it's a bug. Please open also a support case. My Case ID is 7061244.

Disable "Block invalid packets" under Network Protection / Firewall / Advanced / Protocol Handling. That's the only workaround at the moment.

regards

mod

I don't even have them enabled:

I am just logging them. One more reason to be confused, as I am not sure are logged invalid packets allowed and logged, or blocked and logged. 

With this  configuration the packets not blocked