Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 14 replies
  • Subscribers 1 subscriber
  • Views 46935 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Google Play store issues

utmfan
Hi all,

I was wondering if anyone had created an exception rule for Web Filtering on the Google Play store? I've noticed that large application updates like Skype & Chrome won't successfully update with the Web Filtering turned on, though smaller ones seem yo update without issue.

I'm using the filter in transparent mode without HTTPS. Turning the filter off resolves the problem immediately, though I can't find any blocking or errors in the log. It's like the download is just timing out with the web filter turned on?


This thread was automatically locked due to age.
  • 0
    Hi, check the firewall and ips logs, iirc, you'll probably find something in there.

    Barry
  • 0
    I can't find any blocking or errors in the log.

    Also, please show the line(s) related to such a failure.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BarryG
    I am having the same problems - only larger files don't work.
    When I turn off web filtering, everything works, but don't see any blocked connections from my phone to *.android.clients.google.com in the proxy log.

    Also, I found this in the firewall log:
    Default DROP Google Play 193.33.5.45 :80→my external ip addres

    Workaround: put android devices on the transparent mode skip list
  • 0
    Make a firewall rule allowing traffic from internal to Internet on port 5228 (both tcp and udp)

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels
    Make a firewall rule allowing traffic from internal to Internet on port 5228 (both tcp and udp)


    I did that, but I don't think that was what fixed it for me as I have an allow all outgoing rule already. 

    I then added a new exception rule in Web Protection/Web Filtering/Exceptions. Checked everything except the Logging boxes and added "Matching these URLs"  with this URL:  https?://([A-Za-z0-9.-]*\.)?android\.clients\.google\.com/

    Google Play store seems to download properly now!
    Hope this helps someone else.. [:D]
  • 0
    Hi, MrDragon1, and welcome to the User BB!

    If you you had to make a different change than that suggested by apijnappels, there's something you're not telling us...

    Is your Web Proxy in Standard mode?

    Cheers - Bob

    Sorry for any short responses.  Posted from my iPhone.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    I know this is an older thread, but I'm running into the same issue as MrDragon1, so I thought it might be useful to build on what's been discussed already.  Rather than just exempting my Android phone from the web filter entirely, I'd rather get to the root of the problem.  Here are some details:

    I am running the web filter in Transparent Mode without HTTPS scanning.  The web filter logs show no denies, only allows.

    My firewall logs, however, show the following denies when I try to download an app from the Google App Store: 


    2014:03:03-00:01:15 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 

    2014:03:03-00:01:15 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 

    2014:03:03-00:01:15 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 

    2014:03:03-00:01:16 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 

    2014:03:03-00:01:16 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth1" srcmac="0:13:5f:0:52:9b" dstmac="0:1a:8c:13:9:a1" srcip="208.89.54.20" dstip="66.214.64.166" proto="6" length="52" tos="0x00" prec="0x00" ttl="113" srcport="58806" dstport="9333" tcpflags="SYN" 

    2014:03:03-00:01:18 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 

    2014:03:03-00:01:21 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 

    2014:03:03-00:01:28 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 

    2014:03:03-00:01:30 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.106" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="46965" tcpflags="RST" 

    2014:03:03-00:02:04 spintronic-1 ulogd[4397]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60003" outitf="eth0" srcmac="0:1a:8c:13:9:a0" srcip="74.125.239.99" dstip="10.0.1.240" proto="6" length="40" tos="0x00" prec="0x00" ttl="64" srcport="80" dstport="57057" tcpflags="RST" 


    10.0.1.240 is my Android phone's IP, and 74.12.239.108 looks to be one of the App Store servers.

    If I disable the web filter the downloads work just fine.  I also followed apijnappels' recommendation about opening outbound port 5228 on the firewall, but it did not solve the problem.  (I didn't see how it would, since I have a default allow for outbound traffic.)

    Any ideas?
  • 0
    Hi, I wouldn't worry about the RST packets in the firewall log.

    However, you need to check the IPS log; there is at least one IPS rule that is blocking Google Play store.
    see also https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/41225

    Also, please state your UTM version # when reporting a problem.

    Barry
  • 0
    I was able to do this to allow access to google market as well as push notifications from apps on my cell phones. 



     i was successful using this:
    under firewall rules
    I created 2 service definitions
    1 called android games 
    tcp/udp destination port 8253
    source port 1:65535
    2. called google port
    tcp/udp destination port 5228
    source port 1:65535

    so sources are any
    services was called android test (had both service groups in that )
    destinations any
    action allow
    next under IPS >exceptions
    i created a new list called
    cell phone games.
    skip all checks
    for all requests coming from these source networks i had a group of all android devices (cellphones tablets etc)
    going to these destinations
    destination any
    and using these services
    android games 
    google port

    I hope this helps.
Unfiltered HTML