This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Proxy Log - Which interface ?

Hi All,

We are using Sophos UTM as a web proxy, we have multiple internet interfaces.

I'm using a "Multipath" rule to send certain domains out of a certain interface.

But where and in what log will it show me what traffic is going out of what interface ? Although the multipath rule is working (i Think) I need to confirm a few things (I suspect that HTTP traffic is working fine as domains as specified as example.com load fine via HTTP, inc subdomains but not on HTTPS)

Thanks,

This thread was automatically locked due to age.

0 DouglasFoster over 6 years ago

Start with the web filtering logs. If you are seeing a lot of Bad Gateway / Host Not reachable events logged, it might be your multipath. Since the symptoms seem related to protocol (HTTP vs HTTPS), it most likely has nothing with packet routing, and the logs will give you the best clues. Also check out these forum entries:

Symptoms related to MTU

community.sophos.com/.../unable-to-login-on-certain-website-when-using-sophos-utm-as-a-web-proxy

community.sophos.com/.../how-to-ignore-my-isps-dhcp-mtu-of-only-576

Problems with Chrome and Firefox since 9.508, when used with Transparent SSO

community.sophos.com/.../utm-9-509-3---webpage-timeouts-in-chrome-after-upgrade-9-509-3-in-transparent-mode
Cancel
Vote Up 0 Vote Down

Cancel
0 DuncanNewell over 6 years ago in reply to DouglasFoster

Thanks for the reply. They dont really relate to the issue im having. Both internet links work fine, its more of a point how and where can I prove 100% that the rule is working. I think some stuff on this rule isnt working as it should but I need to know where it will tell me in the logs what interface the traffic is going out of.

For example, I could visit a website and search the logs via SSH but I see the traffic but no where can i see any flag that tells me what interface this is going out of.

Thanks, Duncan
Cancel
Vote Up 0 Vote Down

Cancel
0 DKKDG over 6 years ago in reply to DuncanNewell

Hi Duncan,

you can watch the full firewall log via ssh. -> tail f /var/log/packetfilter.log
There you will find your answer.

e.g.
2018:06:13-08:56:20 firewallv8-2 ulogd[9311]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth2.124" outitf="ppp0"

Here you can see the in interface(initf) and out interface(outitf)

best regards

DKNL
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 6 years ago

"I'm using a "Multipath" rule to send certain domains out of a certain interface."

Interesting. Please show a picture of the Edit of this rule.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 DuncanNewell over 6 years ago in reply to BAlfson

By default all traffic lets say goes out of one interface, and we use the multipath to send certain traffic via another interface.

The "Destination" been a group of domain names

Thanks, Duncan
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 6 years ago in reply to DuncanNewell

So, "CloudProxy ..." is a Network Group - that should do what you want! Are all of the members of that group DNS Groups and not DNS Hosts?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 DuncanNewell over 6 years ago in reply to BAlfson

Yes they are DNS group. Problem seems to be related to some HTTPS domains, but im still trying to work out why.

Thanks

Thanks, Duncan
Cancel
Vote Up 0 Vote Down

Cancel