This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Too many users getting blocked by RBL on WAF

Hi there, I work for a medium sized business and we use an SG310 running UTM 9.5. Lately we've had lots of complaints that customers are getting a forbidden error when trying to access our website. When I go into the log, they're all getting blocked due to poor reputation. For a few users that I've interacted with, granting their wan IP an exception to "Block clients with bad reputation" fixed the issue.

However, this is happening more and more and I'm honestly not happy with the RBL our Sophos is currently using. TONS of false positives. Could I get some advice?

1. Where do I go to change which RBL it uses for the reputation check on the WAF?

2. Do you guys have a recommended RBL?

3. Is turning the reputation check off altogether a bad idea?

Thanks,

Dan

This thread was automatically locked due to age.

0 DouglasFoster over 5 years ago

Just turn off that option. WAF uses the email RBLs, and a good email RBL will blacklist residential IP addresses. Your users are not really infected. Wasted a lot of panic when I thought I had malware i. tbe house.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alexander Busch over 5 years ago in reply to DouglasFoster

Or you could activate the option ‘Skip remote lookups for clients with bad reputation’, so the RBL sources aren’t used. Only GeoIP is then used and you're blocking vpn users... At least this is in the manual.
I've done this myself and it's a little more than just disabling ‘Block clients with bad reputation’.

Best regards

Alex

-
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 5 years ago

Dan, I third the recommendation made by Doug & Alex!

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Daniel Avrit over 5 years ago

Thanks everyone for the input and reassurance! I made the change today, seems to have solved to the problem.

Daniel
Cancel
Vote Up 0 Vote Down

Cancel