Sophos Blocking Allowed Category

The block page that you have the screenshot for is normally a category block, however it is also a default block page for some rarer conditions that may not be related to category.  Can you please check the Log Viewer in detailed view, as well as let us know what website they are going to.

Hi Michael,

So the site is PMCAmmo.com. I performed a TraceRT thru Command Line and PMCAmmo Resolves to 82.118.225.48

I checked Log Viewer and it was being blocked as invalid traffic but got it work because I made an exception in Host & Services > FQDN Host > A geoblocking exception list but again it's odd that it's still coming up as invalid traffic as Germany isn't one of our Geoblocked countries, and weapons category isn't blocked. 

Can you do a policy test for PMCAmmo.com

Sophos firewall dashboard-->diagnostics-->URL category lookup--->PMCAmmo.com

Hey Alan,

I can confirm it is indeed classified as Weapons which is correct. 

Hey Michael, thanks for this. I see what you mean, and per your original answer I think that was it, it was geoblocked and since the reason given was category that was were the confusion set in. Moving forward I'm going to sit with my network guy and IT director, and let them know when this comes up again to first test to see where the blocked site is hosted. 

I think the more important thing is, when a site it blocked tehe block page presented to the user has limited information.  You need to look at the Log Viewer and may need to look at both Web Filter and Firewall detailed logs.

Right

So the problem isn't just that the block page is straight up delivering misinformation, but the firewall is blocking a country that isn't even on your geo blocklisted countries?

May we see a screenshot of the firewall  rule if you will? I'm curious to see what firewall rule ID #3 looks like.

Weapons by default is an allowed category, it is not part of any policies. When added to my policies, weapons is blocked. Removed and access is allowed. Then I blocked Bulgaria and the block message is Weapons has been blocked, strange result.

Ian

So that settles it then: the website is based in Bulgaria, so it would be blocked if Bulgaria was blocked. I'm still curious about Hey Help Guy's firewall rule ID #3.

Hi Ian, yes strange indeed.

Hey Alan, so yes after getting everyone's assistance the collective agreement is that the site is blocked because it's in a geoblocked country but since the Firewall can't report that to end users, it simply says it's a blocked category. 

As for my rules, here is a look at all of my current rules: 

So if we drill down into rule #3 more it's a geoblocking rule. Pretty much all countries are on our blocked list. 

Thanks again for your assistance on tackling this issue. I do have a few more other issues but that'll be for other posts. Have a good weekend. 

Hey Alan, so yes after getting everyone's assistance the collective agreement is that the site is blocked because it's in a geoblocked country but since the Firewall can't report that to end users, it simply says it's a blocked category. 

As for my rules, here is a look at all of my current rules: 

So if we drill down into rule #3 more it's a geoblocking rule. Pretty much all countries are on our blocked list. 

Thanks again for your assistance on tackling this issue. I do have a few more other issues but that'll be for other posts. Have a good weekend.