Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 4 subscribers
  • Views 1245 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall Not Blocking Traffic to Cable Modem (192.168.100.1)

busthead

To prevent exploits like Cable Haunt, I created a firewall rule to block access to my cable modem's internal interface, 192.168.100.1.

Source: Any <> Services: Any <> Destination: 192.168.100.1 <> Action: Drop

but I'm still able to reach the cable modem's web interface.

My LAN is 192.168.0.0/24 is masqueraded to my cable modem external interface.

What am I missing?

Thx

 



This thread was automatically locked due to age.
Parents
  • 0

    What are you doing from where when you are "still able to reach the cable modem's web interface?"

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    First answer Bobs Question.

    Next, the WebProxy could interfere.
    This cannot be blocked by firewall rules.
    if a transparent web proxy is in use, you have to create a proxy exception.
    (WebProtection/FilteringOptions/Misc/Transparent Mode Skiplist ... but uncheck "Allow HTTP/S traffic for listed hosts/nets")


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    "still able to reach the cable modem's web interface" = web browser -> cable modem's web interface.

     

    Adding cable modem host (192.168.100.1) to "Skip Transparent Mode Destination Hosts/Nets" did the trick.

     

    Can you please explain why/how a Transparent mode Web Filtering config (layer 7) permits packets to bypass the firewall (layer 3)?

Reply
  • 0 in reply to dirkkotte

    "still able to reach the cable modem's web interface" = web browser -> cable modem's web interface.

     

    Adding cable modem host (192.168.100.1) to "Skip Transparent Mode Destination Hosts/Nets" did the trick.

     

    Can you please explain why/how a Transparent mode Web Filtering config (layer 7) permits packets to bypass the firewall (layer 3)?

Children
Unfiltered HTML