How to block youtube for a particular IP range in Sophos XG

Hi, You will need two rules, one with allow time and the other with block time. You will need to make sure that the ip address range does not appear in any other firewall rules.

Thanks rfcat_vk , will try and let know 

how about blocking youtube for this ip range at all times , would that be achieved as well with these rules ?

Most certainly can but you will need to reduce the traffic access to HTTP/s and block QUIC using the web proxy and policies.

Ian

ohh , that flew over my head , pretty new to Sophos XG , appreciate if you can share any screen shots , thanks mate

Hi,

please review the following link and some of the embedded links. There are also a number of KBA's you should read at the top of the forum.

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/137737/sophos-firewall-home

Ian

Thanks Ian , will check it out and keep posted, much appreciated 

Hi Ruka,

when you create your firewalls and they don't work as expected, please post expanded screenshots of the rules and the edited logviewer entries showing the failure.

Ian

Hi Ian,

Please find attached Firewall rule and Web and App Policy createdSophos block youtube FW rule screen shots.docx

Hi,

Please include them your post, not as seperate documents, makes the thread easier for all to follow.

Why does LAN 4 which appears to be the internet access have an IP address in the internal network. What interface does the Unifi AP connect to?

Ian

Hi,

Please include them your post, not as seperate documents, makes the thread easier for all to follow.

Why does LAN 4 which appears to be the internet access have an IP address in the internal network. What interface does the Unifi AP connect to?

Ian

Hi Ian, 

ISP cable connects to Port 2



Unifi AP Connects to Port 4



IP Range for Port 4 is 



Wanting to block this IP Range



Web Policy created



Application Policy created 

Firewall rule created 

When I enabled this Firewall , Internet is disabled for all wifi users on 10.1.1.1/24

You appear to have two address ranges on port 4. Are you using the unifi ap to assign ip addresses, if so you must have a Nat which the XG will not see the 10 range.

ian

Hi Ian,

Have this on Port 4 



I can change the Unifi Wireless Network to match the above range , if that would help

Do you use the Unifi AP to assign IP Addresses to connections? Managing access and firewall rules is much easier if you allow the XG to assign IP addresses.

Port 4 is a 192.168 address range, the unified clients should also be in that range if you want to suse the XG firewall rules.

What is the aim of using the 10.1 IP address range?

Ian

Hi Ian,

Was wanting to have different networks , like

Port 172.16.16 /24

Port 2 WAN on 192.168.1/24

Port 3 on 10.0.0 / 24

Port 4 on 10.1.1 / 24  

Is there another way to achieve this

Please advise

The unified network needs it own range as you have configured and has nothing to do with port 4.

You have labelled port 4 as LAN it should be WAN then your rules might work.

How do you connect to the internet?

Ian

I believe I'm connected to Internet via Port 2 since WAN cable from ISP is connected to Port 2

Can we name two Ports with WAN label ?

The IP address on port 2 does not seem to be an address an ISP would assign you, more like something you have signed yourself.

Change port 2 to DHCP.

With your setup you would have 3 internal LAN ports and one WAN port.

What is your ISP/RSP?

Ian

Hi Ian , is it because i have Dynamic DNS as below 

Had created them for enabling Sophos Connect ( VPN ) 

My ISP is TPG  ( Fibre to Premise )

So, what has the vpn got to do with your internet connection or do you use it to access YouTube outside of Australia?