User computer using OpenDNS DNS and firewall keeps producing these alerts

It started for less than 5 a day I would guest but yesterday and today WOW!!! Keep on getting this email alerts notifications non-stop on every 1 to 4 minutes.  It's good that Sophos is denying these but is there something I should do? or Are these all False-Positive?

Login to the webUI. Check the source IP and Destination IP. Start investigating into the reason of those traffic. 

Hi,

you blocked out your host name but left your licence id, please edit and remove your licence details.

Ian

Thank you for informing.

Hi,

are you using the web proxy, the logs you supplied indicate there is no Nat rule. Did you change the ca used on some of these computers?
ian

hello;

no. web proxy is not checked on the checkbox.  these log viewer results are filtered for Log Subtype is not Allowed and Dst IP is 208.67.222.222.

i just enabled now web proxy on the inbound and outbound traffic firewall rule.  Also, what is the ca stands for?

Certificate Authority.

The log you published shows the DNS is being provided over GoH (DNS over HTTPS).

Ian

Thank you guys for providing your insights and opinions to these matters.  I did create a new firewall for OpenDNS after my communication with OpenDNS technical support.  Based on them, these are all valid inbound traffic to their OpenDNS DNS hosts 208.67.220.222 and 208.67.222.220.

I also asked for their recommended firewall rules for their services and here are the url links provided to me:

• https://docs.umbrella.com/deployment-umbrella/docs/2-prerequisites-1
• https://docs.umbrella.com/deployment-umbrella/docs/2-prerequisites-update
  

I then created a firewall rule for OpenDNS with the recommend TCP and UDP protocols.  Seems to be all working and no more of never ending cycles of False-Positive IPS Notification Alerts.

FYI:  I did try enabling Web Proxy and it did also works.  However based with my understanding, DPI is newer and better way of security features for web services.

Reference To Techvids: https://techvids.sophos.com/watch/uCC7QqkYcTJtLiBMNhZV32