This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Should this rule not effectively disable the PC defined in rule #4 ?

Escape75 over 5 years ago

I thought all outgoing packets are going to be dropped so internet would not be accessible,

but it doesn't matter if the rule is on bottom or top, the internet works just fine ...

This thread was automatically locked due to age.

0 DouglasFoster over 5 years ago

yes, but you also need to be aware that firewall rules do not always apply. Read the Wiki articles for help with that.
Cancel
Vote Up 0 Vote Down

Cancel
0 Escape75 over 5 years ago in reply to DouglasFoster

Hmm, well in the above case it must not apply because it's definitely not cutting Internet access to that device :)
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 5 years ago

Hi and welcome to the UTM Community!

As an introduction to Doug's great Wiki offerings, glance at #2 in Rulz.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasFoster over 5 years ago in reply to Escape75

Your posted question and your goal are inconsistent.

The low-numbered Allow-All rule will take precedence over the high-numbered Block rule, assuming that the PC is part of the Internal Network.

However, the web filtering proxy is an alternative packet path to the firewall rules. If you have either web proxy mode enabled for the source address of the PC, none of these rules matter at all. That is why I asked you to read the tutorials which we have created on this forum.
Cancel
Vote Up 0 Vote Down

Cancel
0 Escape75 over 5 years ago in reply to DouglasFoster

Thank you, yes I do have Web Filtering (on) in Transparent Mode so that would do it ...

As far as the rules I had the deny rules on top as well (position 2) but there was no difference.

I just wasn't thinking that web filtering would be alternate path to the network firewall :)
Cancel
Vote Up 0 Vote Down

Cancel