Basic set of firewall rules for a very basic office

Question

Hello, 
 I'm new to Sophos, and am deploying my first firewall to a very basic client, and just want to check what I have configured is a reasonable balance between security and functionality? I am just looking for opinions and whether I have missed anything major? I do understand setting security can be like measuring the length of string so to speak. 
 Note as I don't want to risk too many problems I have just allowed everything LAN to LAN. 
 Also note I have a disabled 'deny LAN and WiFi to Internet' rule at the top so it can quickly be isolated in case of attack. 
 The allowed services for access to the web are; 
 DNS, FTP, HTTP, HTTPS, ICMP, ICMPv6, NTP, SIP, SIP-MSNmessenger, SNMP

Mark Tarrant · Accepted Answer

Note I just reversed the source and destinations for the 'Block Russian Iranian North Korean' rule as it was obviously wrong. I have tested it ok, and have also tested the internet via various sites ok

Mayur Makvana · Answer

Hello Mark Tarrant , 
 
 Thank you for reaching to Sophos Commuinity! 
 In addition, you may review couple of KBA of the best practices: 
 https://support.sophos.com/support/s/article/KB-000042127?language=en_US 
 https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/StartupHelp/RuleBestPractice/index.html 
 https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Administration/DeviceAccess/DeviceAccessBestPractices/index.html 
 /cfs-file/__key/communityserver-discussions-components-files/126/7245.Securing-your-Sophos-XG-Firewall-_2D00_-Best-Practice-Guide.pdf

Mark Tarrant · Answer

Thanks Ian! I will make some changes and will post back.

rfcat_vk · Answer

Hi, 
 the blocking will only block outgoing traffic and should be the top rule. 
 I would change any of your source to LAN and the network to improve security. Your mail setting is an open, so change it to source ZONE to LAN and network to the LAN network. 
 Unless you have IPv6 configured on your XG I would remove the ICMPv6. 
 Ian

Basic set of firewall rules for a very basic office

Top Replies