This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

No Access to cloudflare subdomains from Windows and Linux Mint

Hi guys,

as the title suggests, I have issues with accessing subdomains, where the domain is hosted at Cloudflare.

I have set up a Cloudflare tunnel to some services on my unraid host and now I have issues accessing them from my internal LAN. The unraid server is in a DMZ and I try to access them from my LAN with either Windows 10 or a Linux Mint machine. Unfortunately, this doesn't work. All other services on the unraid host, I can access normally from W10/LM. It's very strange, that on my iPhone/iPad these subdomains work without any issue in the same network. When I'm on another network outside my home, I have full access to the services independent from the used OS. So the problem exists only on my W10/LM machines in my LAN.

The UTM uses the latest firmware and everything is uptodate.

I think I was also affected by this issue, because I got warnings from Advanced Threat Management. So I'm not sure, if the known issue is related to my specific problem.

What I have tried so far:

- cleared browser cache and restart browser

- ping the subdomains in the terminal (error: service or host not known)

- ping the ip from one of the subdomain (ping is successful)

- Switch off Advanced Threat protection for 15 minutes

- Create an ATM exception for the subnet, where the domain is hosted

My W10/LM and my Apple devices use the same DNS Server (Adguard plus unbound), so it should be very strange, if this is the problem.

Has anyone an idea, what could be the problem?

If you need further information, don't hesitate to ask.

Thank you very much for your help.

Maginos

This thread was automatically locked due to age.

Parents

0 Vivek Jagad over 1 year ago

Hello Maginos218 ,

Thank you for reaching out to the community, may we know the mode of operation for web protection is it standard or transparent ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

Hello Vivek Jagad ,

thank you for your reply.

The web filter is switched off, the application control is turned on, but has no rules enabled.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

okay can we you share tcpdump ?
#tcpdump -nei any host <dst _ip>

and clear any conntrack established
#conntrack -D -d <dst_ip>

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

This is the output from tcpdump:

When I try to access the subdomain via webbrowser, nothing happens in tcpdump. The entries you see here are from a ping to the destination ip.

conntrack cleared 0 flow entries.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

Okay then can you start wireshark on the client machine to analyze the packet initiated for sub-domains ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

Is this enough information or do you need more?
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

This are just DNS Queries, can you share a a pcap file ?
Basically I want to take a look into the initial packets [3-way handshake and following with the datapackets ] for the subdomains from your client machine !

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

Since I cannot upload it here directly, I used my nextcloud to share it.

Edit: Link to Nextcloud was removed.

The output was anonymized with Tracewrangler. I hope you get your desired information though.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

Did not received any sufficient information I was looking for, I would suggest log a service request and let support assist you to narrow the situation on a remote session and help you with the conclusion !

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

Ok. Do I get support with Sophos UTM Home free license? As far as I know, I only get support from the Support Articles and the AI chatbot.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to Maginos218

I am afraid for home you wouldn't !

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Maginos218 over 1 year ago in reply to Vivek Jagad

That's what I expected. Do you have any recommendation what I could do which is more than wait for a future update of the UTM/WIN10/LM and hope, that it will work again?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Maginos218 over 1 year ago in reply to Vivek Jagad

That's what I expected. Do you have any recommendation what I could do which is more than wait for a future update of the UTM/WIN10/LM and hope, that it will work again?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data