Integrate synthetic allowlist in a rule without WAF

Question

Dear community, 
 As a firewall noob I am wondering how to integrate a dynamically changing list of IPs into an allowlist for a specific firewall rule. 
 As a home user I unfortunately have no access to the "Web protection subscription", only "Base Firewall". 
 The aim is to allow Grafana Cloud servers to periodically poll data from my internal Prometheus instance on a specific web server port. This actually works with a firewall rule set to 
 Source zone WAN: any, 
 Source network: any 
 Destination zone: LAN, 
 Destination network: any, 
 Services "prometheus HTTPS" (TCP Destination Port 9090) 
 and three corresponding NAT-rules created by the NAT wizard 
 Obviously I do not want to publish the Prometheus data to the whole internet, so I want to restrict the access to certain known IP-addresses, so "Source network and devices" within a firewall rule would be the right place to add Grafana's IPs. Unfortunately the IPs are from *.bc.googleusercontent.com and therefore subject to change dynamically. 
 The DNS-record "src-ips.hosted-grafana.grafana.net" resolves to more than 100 IPv4 and quite as much IPv6-addresses, but when I put that record into Source network (DNS-Address) the Grafana service cannot reach my internal server. 
 Most probably I am missing a point where to put the DNs-Record for the IP list into apart from &bdquo;,Source networks and devices&ldquo;, can you help me in finding it? 
 
 Thanks in advance, 
 Oliver

Mayur Makvana · Accepted Answer

Hello, 
 Thank you for contacting Sophos Community! 
 Currently, we do not have an option to allow access to internal server wherein the source can be specified using the FQDN. Though I will check internally and confirm. 
 You could restrict based on the source country if that helps.

Raphael Alganes · Answer

Hello Oliver, 
 Good day and thanks for reaching out to Sophos Community. 
 I believe the feature you're specifically looking for your objective isn&rsquo;t yet available on Sophos Firewall and is still under Feature Request - SFSW-I-2023 - Using External Dynamic List for IP, FQDNs and Services. 
 No ETA yet for the feature. Since you're a home user and wouldn't be able to request this through your Sophos account, is to be on the lookout in Sophos Community for - release notes, Blogs, and Forums that might contain any updates about this feature. 
 Hope this helps. 
 Thank you

rfcat_vk · Answer

Hi Oliver, 
 sales will not be able to help you because you are a home user, all licences are evaluation. I still think you are using the wrong licence. Please try creating a new home licence . 
 Ian

rfcat_vk · Answer

Hi Oliver, 
 I am not sure about the home licence on an XGS because there is a piece of hardware in the traffic path that I am not sure is supported by the home licence and that is the NUC. 
 My XG115W is not a home licence but a supported licence. 
 Ian

Integrate synthetic allowlist in a rule without WAF

Top Replies