This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF don't recognize domain-names

i try to publish 2 webpages with WAF.
because "redirect to HTTPS" is not working, i create different rules for HTTP / HTTPS
my setup:
2 Webserver - vServer1 & vServer2
2 Domains - www.domain1.de & www.domain2.de

4Rules:
http www.domain1.de -> vServer1
https www.domain1.de -> vServer1
http www.domain2.de -> vServer2
https www.domain2.de -> vServer2
(within domain field i have only one domain)
... looks simple.

But if i try to reach the webpages via http (port80) only the first rule matches and I see the webpage from vServer1 all the time. This occurs with http://www.domain1.de and http://www.domain2.de

I never reach rule 3. The traffic counter counts at rule 1 only. I see the webpage from vServer1 all the time.
If i change the rule-order, the other HTTP Rule matches all the time - for all domains. (the current first http rule)

if i use https .. it works. The correct rule matches and i see the correct webpage.

Currently i am unable to isolate the corresponding lines from reverseproxy.log.

This thread was automatically locked due to age.

Parents

0 Keyur over 4 years ago

Hi dirkkotte

The firewall rule works top to bottom approach so if port 80 firewall rule is on top and if you generate a request by entering URL www.domain1.de, it will initiate the traffic over port 80 and first rule match and it will allow the traffic, you have to https://www.domain1.de in the browser in the address box to initiate the traffic over port 443 and firewall will try to match the firewall rule and when it matches with Port 443 firewall rule it will connect to that specific server.

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 4 years ago in reply to Keyur

Hi,

thanks for the answer. But i think you misunderstood.

www.domain1.de and www.domain2.de are webpages hosted within my own DMZ.

I try to use WAF Rules (formally business application rule).

Within WAF rules i have the "Domain" field. I think only domains listed here should match the rule.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 4 years ago in reply to dirkkotte

Hi dirkkotte

Do you mean you have explicitly defined the domain in WAF rules?

Are you trying to access the server from the Internet side from the LAN zone of the firewall?

It would be great if you could share more details about your requirements.

You can refer to the configuration and troubleshooting articles

https://community.sophos.com/kb/en-us/126470

https://community.sophos.com/kb/en-us/124574

https://community.sophos.com/kb/en-us/122829

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 4 years ago in reply to Keyur

Hi,

Do you mean you have explicitly defined the domain in WAF rules? -- YES

Are you trying to access the server from the Internet side from the LAN zone of the firewall? -- INTERNET

It would be great if you could share more details about your requirements. -- see attachments

If i try to access www.???4.de (defined as Domain2) i got no match from Rule#4 but Rule#1.

I see the page from Server behind Rule#1.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 dirkkotte over 4 years ago in reply to Keyur

Hi,

Do you mean you have explicitly defined the domain in WAF rules? -- YES

Are you trying to access the server from the Internet side from the LAN zone of the firewall? -- INTERNET

It would be great if you could share more details about your requirements. -- see attachments

If i try to access www.???4.de (defined as Domain2) i got no match from Rule#4 but Rule#1.

I see the page from Server behind Rule#1.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Evianne over 4 years ago in reply to dirkkotte

Hello Dirk,

Why is "redirect to HTTPS" not working for you?

Can you please share or PM me the content of the file /cfs/waf/reverseproxy.conf?

Best

Sabine
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 4 years ago in reply to Evianne

Why is "redirect to HTTPS" not working for you?

don't know... possible the same problem with "normal" http access i currently see.

I pm you the file-content asap.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 4 years ago in reply to dirkkotte

Yesterday i tryed again to switch web-server-publishing from Sophos SG to XG.

This time i don't get access at port 80. No log entries. (show all logs and filter to the external client-IP)

If i change WAF listening port from port 80 to 81 (here i use the ISP-router to change incomming port 80 to 81 while DNATting/Forwarding ) all works great.

With SSL-Publishing i have never problems.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel