Unrestricted web site access on wireless network

Question

Hello. 
 I have a UTM9 (9.605-1 to be exact) and have recently created a new wireless network for staff to use on their personal devices (to allow them access to social media, file sharing, etc without being on the corporate LAN). It works apart from some sites just time out and don't work (mainly icloud.com, some web mail and online banking). There is no message to say it has been blocked by the web filtering so I assume it is not. 
 Have I missed something? Is there additional configuration required to allow completely unrestricted web access from a particular wireless network? I've tried creating a firewall rule to allow any traffic to any destination but that doesn't work. 
 Any help appreciated! 
 Thanks.

DouglasFoster · Answer

If the traffic goes through UTM on its way to the Internet, the Transparent Web Filter may be handling the traffic. The "Allowed Networks" list for each filter profile determines whether the packet is accepted or not. If you want to exclude that traffic from any filtering, you need to ensure that the subnet is not covered by any of the Allowed Networks lists. But if Web Filtering is blocking the traffic, you should see a blocked message (for http) or a certificate error (followed by a block message if you proceed anyway) for https. 
 If the traffic matches an Allowed Networks list, the next step is to consider whether https decrypt-and-scan is enabled for that profile or not. Some sites have locked down their ciphersuites so tightly that UTM cannot connect to them when decrypt-and-scan is enabled. This should generate a "connection refused" error, which should also produce a certificate error followed by a block page. 
 A third possibility is that the IPS subsystem is blocking the traffic. Check to see if the guest network is considered part of the "Internal Networks" list, and check the logs for evidence of traffic being blocked. For best security I think you want this traffic excluded from the Internal Networks list used by IPS, but I do not know how that will affect filtering. IPS blocks replies, so the symptom will be a timeout problem. 
 But you may also have a routing or DNS problem. The evidence against this is that you say it only affects some websites. 
 Once your problem is understood, I recommend enabling transparent web filtering for guest users (probably without authentication and without decrypt-and-scan). Create a profile with only the most objectionable content blocked. I would also suggest configuring the DHCP server to direct DNS to Neustar DNS or Quad9 DNS, which block DNS lookups for known-bad DNS names. I am assuming that your company lawyers and your human resources department probably want to prevent users on your guest network from downloading pornography or malware, even if the target is a personal device. 
 You may also want to implement traffic shaping, to prevent one guest user from hogging all the bandwidth.