This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

No Access to cloudflare subdomains from Windows and Linux Mint

Hi guys,

as the title suggests, I have issues with accessing subdomains, where the domain is hosted at Cloudflare.

I have set up a Cloudflare tunnel to some services on my unraid host and now I have issues accessing them from my internal LAN. The unraid server is in a DMZ and I try to access them from my LAN with either Windows 10 or a Linux Mint machine. Unfortunately, this doesn't work. All other services on the unraid host, I can access normally from W10/LM. It's very strange, that on my iPhone/iPad these subdomains work without any issue in the same network. When I'm on another network outside my home, I have full access to the services independent from the used OS. So the problem exists only on my W10/LM machines in my LAN.

The UTM uses the latest firmware and everything is uptodate.

I think I was also affected by this issue, because I got warnings from Advanced Threat Management. So I'm not sure, if the known issue is related to my specific problem.

What I have tried so far:

- cleared browser cache and restart browser

- ping the subdomains in the terminal (error: service or host not known)

- ping the ip from one of the subdomain (ping is successful)

- Switch off Advanced Threat protection for 15 minutes

- Create an ATM exception for the subnet, where the domain is hosted

My W10/LM and my Apple devices use the same DNS Server (Adguard plus unbound), so it should be very strange, if this is the problem.

Has anyone an idea, what could be the problem?

If you need further information, don't hesitate to ask.

Thank you very much for your help.

Maginos

This thread was automatically locked due to age.

0 Vivek Jagad over 1 year ago

Hello Maginos218 ,

Thank you for reaching out to the community, may we know the mode of operation for web protection is it standard or transparent ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

Hello Vivek Jagad ,

thank you for your reply.

The web filter is switched off, the application control is turned on, but has no rules enabled.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

Can you create a plain firewall rule with any service and and FQDN or wildcard for cloudflare [destination] with source as your local lan and then check ?
And then upon accessing the subdomain, check the packetfilter.log
Under the advance shell
tail -f / var/log/packetfilter.log | grep < src ip>

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

I only see entries in the packetfilter.log where dstip=ip_of_utm and dstport=gui_port_of_utm.

When I try to access one of my subdomains, no entry appears in the packetfilter log, only when I go to different sites in the utm web gui.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

Can you check the policy test once and share a screenshot ?
And do you see any logs under the tail -f /var/log/http.log ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

So here's the screenshot.

The /var/log/http.log is empty.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

Can you place the rule position to the top and then check ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

It's already the top of the "user created firewall rules". The first seven firewall rules are automatically created rules.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

okay can we you share tcpdump ?
#tcpdump -nei any host <dst _ip>

and clear any conntrack established
#conntrack -D -d <dst_ip>

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

This is the output from tcpdump:

When I try to access the subdomain via webbrowser, nothing happens in tcpdump. The entries you see here are from a ping to the destination ip.

conntrack cleared 0 flow entries.
Cancel
Vote Up 0 Vote Down

Cancel