Sophos Firewall - WAF response 403 Forbidden for Internal requests

Please post a coy of your WAF rule. Do the users access the external interface using a firewall to allow them out and so do you have a hairpin NAT setup to allow users to access your external interface?

Ian

Hi R Beatrix ,

Thank you for reaching out to the community, please refer the following useful KBAs:
1.) 403 forbidden detections.
2.) WAF troubleshooting scenarios.

This sounds to me like this situation:
RE: WAF Rules Allowing Unexpected Requests Port 80 and 443 open from external if using external IP address. Support says it goes to first rule that matches the port and ignores host name??? 

Thank you for the reply!

Below is a screenshot of the Edit page for the WAF Firewall Rule.

I read that thread before posting here; the difference is that I'm not concerned with how the WAF responds for requests made directly to the IP address.

When I make a request to the domain name (which is configured in the Domains input of the WAF rule) from an external WAN client, the request passes and works as expected.  The problem is that making the same request (using the domain name) from an internal LAN client is being blocked by the WAF, returning me 403 Forbidden.

Thank you for the screenshot of the WAF rule. I still think the issue is with the internal addressing not being translated to an acceptable external address or not in the allowed access address range.

Ian

Are you meaning the Allowed client networks area under "Access permission" on the WAF rule page? 

I have entered "Any IPv4" value here; so I'm expecting that this is allowing access from any IPv4 address, including all that may come from WAN requests and all subnet IPs from our internal LAN networks.

Hi,

if you run an nslookup and tracert to the web server url, what are the results?

I saw that entry, but I am not sure how XG treats none routable addresses?

Ian

Thanks for posting these KBA links Vivek.

I tried the option of tailing the reverse proxy log to try and capture any errors.  I was able to capture the following log lines immediately after making a connection attempt to the WAF-protected domain from my internal LAN client.

The logs seem to indicate the following issue: AH01630: client denied by server configuration: proxy:balancer://611f5a0dc89ff6797ef98e2cf59c24af/

[Thu Apr 25 23:56:51.688378 2024] [authz_core:error] [pid 13483:tid 140015396878080] [client 192.168.2.23:61133] AH01630: client denied by server configuration: proxy:balancer://611f5a0dc89ff6797ef98e2cf59c24af/

[Thu Apr 25 23:56:51.687851 2024] timestamp="1714089411" srcip="192.168.2.23" localip="35.34.33.32" user="-" method="GET" statuscode="403" reason="-"
extra="-" exceptions="-" duration="994" url="/" server="www.example.com" referer="-" cookie="wfx_unq=MHsJtyXbMXiJypTH" set-cookie="-"
recvbytes="2669" sentbytes="586" protocol="HTTP/1.1" ctype="text/html" uagent="Mozilla/5.0 (WindowsNT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
querystring="" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" ruleid="17"

As a test, I added my internal LAN network in the "Allowed client networks" configuration for the WAF rule (screenshot below), but that didn't help.  Logging still shows the "client denied by server configuration" messages.

How would the internal address arrive on the external interface/?

Ian