How to block youtube for a particular IP range in Sophos XG

Hi, You will need two rules, one with allow time and the other with block time. You will need to make sure that the ip address range does not appear in any other firewall rules.

Thanks rfcat_vk , will try and let know 

how about blocking youtube for this ip range at all times , would that be achieved as well with these rules ?

Hi,

Please include them your post, not as seperate documents, makes the thread easier for all to follow.

Why does LAN 4 which appears to be the internet access have an IP address in the internal network. What interface does the Unifi AP connect to?

Ian

Hi Ian, 

ISP cable connects to Port 2



Unifi AP Connects to Port 4



IP Range for Port 4 is 



Wanting to block this IP Range



Web Policy created



Application Policy created 

Firewall rule created 

When I enabled this Firewall , Internet is disabled for all wifi users on 10.1.1.1/24

You appear to have two address ranges on port 4. Are you using the unifi ap to assign ip addresses, if so you must have a Nat which the XG will not see the 10 range.

ian

Hi Ian,

Have this on Port 4 



I can change the Unifi Wireless Network to match the above range , if that would help

Do you use the Unifi AP to assign IP Addresses to connections? Managing access and firewall rules is much easier if you allow the XG to assign IP addresses.

Port 4 is a 192.168 address range, the unified clients should also be in that range if you want to suse the XG firewall rules.

What is the aim of using the 10.1 IP address range?

Ian

Hi Ian,

Was wanting to have different networks , like

Port 172.16.16 /24

Port 2 WAN on 192.168.1/24

Port 3 on 10.0.0 / 24

Port 4 on 10.1.1 / 24  

Is there another way to achieve this

Please advise

The unified network needs it own range as you have configured and has nothing to do with port 4.

You have labelled port 4 as LAN it should be WAN then your rules might work.

How do you connect to the internet?

Ian

I believe I'm connected to Internet via Port 2 since WAN cable from ISP is connected to Port 2

Can we name two Ports with WAN label ?

The IP address on port 2 does not seem to be an address an ISP would assign you, more like something you have signed yourself.

Change port 2 to DHCP.

With your setup you would have 3 internal LAN ports and one WAN port.

What is your ISP/RSP?

Ian

Hi Ian , is it because i have Dynamic DNS as below 

Had created them for enabling Sophos Connect ( VPN ) 

My ISP is TPG  ( Fibre to Premise )

Hi Ian , is it because i have Dynamic DNS as below 

Had created them for enabling Sophos Connect ( VPN ) 

My ISP is TPG  ( Fibre to Premise )

So, what has the vpn got to do with your internet connection or do you use it to access YouTube outside of Australia?

No , i dont access YouTube etc outside of Australia 

Was thinking if the Dynamic DNS config was an issue , so posted it

Please advise

No, there is something wrong with your connection. I will ask whirlpool about TPG FTTP IP addressing.

Ian

thanks mate

Sorry Ian , I missed a bit 

Cable from NBN box connects to WAN port of Tplink router and from LAN port of Tplink connects to Port 2 of Minipc which has Sophos XG installed on , which is why I believe Port 2 is getting 192.168.1  address

Sorry about the muck up 

Try plugging the XG directly into the NBN box, not using the TP-link.

Ian

Morning Ian ,

Sophos box does not pick up , which is why I had to use the tp-link

You need to check the settings in the to-link because tpg I believe use VLANs.

ian

Thanks Ian , will check on it

If its VLAN , please advise what i should be checking with TPG to change it to

Else i can shop for other ISP who provides the requirement

Appreciate your assistance

TPG will not change their connection method, I use Aussie BB, they don't use any special connection methods. I suggest you check the whirlpool forums for advice on other ISP/RSPs.

Ian