Sophos Firewall WAF Policy Crashing System

Question

Hello Sophos Community 
 Using the latest firmware as of today (SFOS 19.5.0 GA-Build197) on Sophos Firewall, installed as a virtual appliance in Proxmox 7.3-4. It's a home license, on 4 virtual CPUs (host), and 6GB memory. I'm using the official qcow2 images. 
 I am hosting a Wordpress blog behind it, using WAF, which I use mainly for sharing family pictures and videos. Below is a screenshot of the policy.

When this policy is applied to the firewall rule, everything works fine until I attempt to upload a very large file to the blog. Recently, I attempted to upload our family's Christmas morning video to my site, which was 1.3GB. Not only did it fail, but the entire firewall crashed... and crashed hard. The house went offline, DNS resolution went down, I couldn't connect to the firewall via the IP address, nothing. It just died. I had to go into Proxmox, kill the VM, then restart it. Upon restart everything was fine. 
 If I remove the WAF policy, the file uploads. If I enable the WAF policy and transfer the file, everything comes crashing down. It's a very easily reproduced. What could be causing this?

John Groller · Accepted Answer

I have ignored filter id 200004, and so far every video I've tried (up to 650MB) is working fine. It completes and the server does not freeze or crash. I want to keep testing this through tomorrow, but so far this is a suitable workaround for me. 
 I'd still suggest a defect for the Sophos engineers to look at though. I'm fine ignoring a filter, but I still worry that I may do something else which brings down the firewall (that shouldn't). It seems like this has the potential to be critically impactful for others. Fortunately for me it was just my home impacted. Happy to provide whatever information necessary to help. 
 Thank you all for your help and time in troubleshooting the issue.

AttilaKovacs · Answer

Yes, unfortunately the UI doesn't allow you to skip a rule on site path level, you can only do that in the protection profile, which is applied to the whole WAF rule. 
 What you can do is block access to /wp-admin from any network in the original WAF rule, and create a second rule that only provides access to /wp-admin with another protection policy that has the problematic rule skipped. 
 This also allows you to have better control over who can access wp-admin. I guess the best practice would be to totally lock down this path from the Internet and only allow access to it from your internal network or from specific IPs, that way no attacker can access it. But this is just tweaking you can think about, not related to the original problem.

Sophos Firewall WAF Policy Crashing System

Top Replies