https://community.sophos.com/utm-firewall/f/network-protection-firewall-nat-qos-ips/41059/firewall-fails-to-block-an-established-udp-connectionHello Guys, I am have a weird situation here. I have a PC communicating with a server, both connected to my Sophos Firewall (Firmware: 9.100-16 - not an appliance). I have a Rule that allows this connection, and it works. Without that Rule, theen-USTelligent Community 12https://community.sophos.com/thread/143310?ContentTypeID=1Fri, 06 Mar 2015 15:27:02 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:b6ac1f63-3628-475a-9ab9-85ecd308d236PaulHoltI&nbsp;concur.&nbsp;&nbsp;I&nbsp;have&nbsp;users&nbsp;continuing&nbsp;to&nbsp;use&nbsp;apps&nbsp;long&nbsp;after&nbsp;their&nbsp;allowed&nbsp;time.&nbsp;[:(] <br /> <br />Paul<div style="clear:both;"></div>https://community.sophos.com/thread/143309?ContentTypeID=1Fri, 23 Jan 2015 22:10:07 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:7c308f12-b918-4dc0-8880-7953e0dea83cbblankI&nbsp;am&nbsp;afraid&nbsp;to&nbsp;say&nbsp;but&nbsp;it&nbsp;appears&nbsp;that&nbsp;this&nbsp;bug&nbsp;has&nbsp;reappeared:&nbsp;Mantis&nbsp;ID&nbsp;27685.<br /><br />I&nbsp;use&nbsp;time&nbsp;based&nbsp;rules&nbsp;and&nbsp;they&nbsp;no&nbsp;longer&nbsp;block&nbsp;established&nbsp;connections&nbsp;when&nbsp;the&nbsp;time&nbsp;period&nbsp;is&nbsp;reached.&nbsp;&nbsp;<br /><br />Is&nbsp;anyone&nbsp;else&nbsp;seeing&nbsp;this&nbsp;behavior&nbsp;again&nbsp;besides&nbsp;me?&nbsp;&nbsp;I&nbsp;am&nbsp;on&nbsp;version:&nbsp;9.305-4<br /><br />Thanks,<br /><br />Bob&nbsp;B<div style="clear:both;"></div>https://community.sophos.com/thread/143308?ContentTypeID=1Fri, 20 Dec 2013 08:02:58 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:cb434e78-9c88-4013-bb7b-9aed8dd5ff5abblankI&nbsp;agree&nbsp;that&nbsp;this&nbsp;appears&nbsp;to&nbsp;be&nbsp;fixed&nbsp;now&nbsp;after&nbsp;limited&nbsp;testing.&nbsp;&nbsp;THANKS&nbsp;Sophos&nbsp;for&nbsp;fixing&nbsp;this&nbsp;bug!<div style="clear:both;"></div>https://community.sophos.com/thread/143307?ContentTypeID=1Thu, 19 Dec 2013 19:08:43 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:973e1e12-c7f5-4595-825e-75df0e2b5ed3jeff.wellingThis&nbsp;is&nbsp;resolved&nbsp;in&nbsp;9.107-33&nbsp;which&nbsp;is&nbsp;available&nbsp;now.&nbsp;I&#39;ve&nbsp;just&nbsp;tested&nbsp;this&nbsp;myself&nbsp;and&nbsp;my&nbsp;SSH&nbsp;session&nbsp;was&nbsp;disconnected&nbsp;after&nbsp;being&nbsp;established.<div style="clear:both;"></div>https://community.sophos.com/thread/143306?ContentTypeID=1Tue, 03 Dec 2013 10:10:19 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:cfbccef4-ed30-4334-87e3-c7f258b338a8jeff.wellingbblank&nbsp;I&nbsp;didn&#39;t&nbsp;test&nbsp;it,&nbsp;I&nbsp;checked&nbsp;the&nbsp;release&nbsp;notes&nbsp;and&nbsp;this&nbsp;issue&nbsp;is&nbsp;marked&nbsp;as&nbsp;resolved&nbsp;in&nbsp;this&nbsp;release.&nbsp;This&nbsp;issue&nbsp;has&nbsp;to&nbsp;do&nbsp;with&nbsp;connection&nbsp;tracking&nbsp;and&nbsp;the&nbsp;way&nbsp;the&nbsp;iptables&nbsp;rules&nbsp;are&nbsp;layered.<div style="clear:both;"></div>https://community.sophos.com/thread/143305?ContentTypeID=1Tue, 03 Dec 2013 08:49:19 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:10b08dbf-3b48-4183-a054-370117ee02a0bblankThanks&nbsp;Jeff...&nbsp;&nbsp;Did&nbsp;you&nbsp;happen&nbsp;to&nbsp;test&nbsp;it&nbsp;with&nbsp;the&nbsp;Web&nbsp;Proxy&nbsp;Enabled/Disabled?<div style="clear:both;"></div>https://community.sophos.com/thread/143304?ContentTypeID=1Mon, 02 Dec 2013 21:30:49 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:71f30171-5730-4ed9-85eb-c1885dfa6a38jeff.wellingTry&nbsp;the&nbsp;soft-release&nbsp;9.107&nbsp;which&nbsp;was&nbsp;just&nbsp;released&nbsp;recently,&nbsp;I&nbsp;think&nbsp;it&#39;s&nbsp;fixed&nbsp;in&nbsp;there.&nbsp;Sadly&nbsp;you&nbsp;can&#39;t&nbsp;get&nbsp;to&nbsp;9.107&nbsp;from&nbsp;the&nbsp;beta&nbsp;but&nbsp;there&nbsp;should&nbsp;be&nbsp;another&nbsp;beta&nbsp;update&nbsp;soon.<div style="clear:both;"></div>https://community.sophos.com/thread/143303?ContentTypeID=1Sun, 01 Dec 2013 09:02:15 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:5f5f17ce-566f-4605-ade0-e486fe6a9987bblankThis&nbsp;issue&nbsp;still&nbsp;existed&nbsp;for&nbsp;me&nbsp;in&nbsp;version&nbsp;9.171.&nbsp;(Beta)<div style="clear:both;"></div>https://community.sophos.com/thread/143302?ContentTypeID=1Fri, 08 Nov 2013 21:50:25 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:db140e52-0a36-4603-92ac-deeadd8e7359jeff.wellingI&nbsp;don&#39;t&nbsp;think&nbsp;this&nbsp;fix&nbsp;is&nbsp;included&nbsp;in&nbsp;this&nbsp;version&nbsp;of&nbsp;the&nbsp;beta&nbsp;yet.&nbsp;I&nbsp;would&nbsp;wait&nbsp;for&nbsp;the&nbsp;next&nbsp;beta&nbsp;version&nbsp;and&nbsp;try&nbsp;it&nbsp;again.<div style="clear:both;"></div>https://community.sophos.com/thread/143301?ContentTypeID=1Fri, 08 Nov 2013 19:36:20 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:e86a7187-47f2-4899-93c7-de976a5c0099PaulHoltI&#39;m&nbsp;using&nbsp;9.2&nbsp;beta&nbsp;now&nbsp;and&nbsp;my&nbsp;initial&nbsp;test&nbsp;show&nbsp;the&nbsp;same&nbsp;problem.&nbsp;&nbsp;I&nbsp;have&nbsp;a&nbsp;simple&nbsp;setup&nbsp;with&nbsp;few&nbsp;rules...&nbsp;&nbsp;will&nbsp;do&nbsp;some&nbsp;more&nbsp;testing&nbsp;and&nbsp;report&nbsp;back.<div style="clear:both;"></div>https://community.sophos.com/thread/143300?ContentTypeID=1Mon, 23 Sep 2013 12:42:21 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:cb56f790-4488-4107-ac83-e3b8f35472e4Michael DunnAFAIK&nbsp;this&nbsp;issue&nbsp;is&nbsp;fixed&nbsp;in&nbsp;9.2&nbsp;(at&nbsp;least&nbsp;the&nbsp;Mantis&nbsp;is&nbsp;resolved).&nbsp;&nbsp;I&nbsp;have&nbsp;not&nbsp;tested.<br /><br />You&nbsp;should&nbsp;see&nbsp;an&nbsp;announcement&nbsp;regarding&nbsp;9.2&nbsp;beta&nbsp;soon.&nbsp;&nbsp;[:)]<div style="clear:both;"></div>https://community.sophos.com/thread/143299?ContentTypeID=1Wed, 28 Aug 2013 09:54:55 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:2baebc60-3026-4492-9051-f90c813faaebgilipeledHi&nbsp;,<br /><br />This&nbsp;issue&nbsp;has&nbsp;existed&nbsp;ready&nbsp;in&nbsp;this&nbsp;version&nbsp;as&nbsp;far&nbsp;as&nbsp;I&nbsp;remember.<br />I&nbsp;don&#39;t&nbsp;know&nbsp;when&nbsp;I&nbsp;was&nbsp;working&nbsp;.<br />I&nbsp;do&nbsp;know&nbsp;it&nbsp;will&nbsp;be&nbsp;fixed&nbsp;in&nbsp;9.2&nbsp;at&nbsp;least&nbsp;that&nbsp;is&nbsp;the&nbsp;info&nbsp;i&nbsp;got&nbsp;from&nbsp;the&nbsp;high&nbsp;level&nbsp;support&nbsp;regarding&nbsp;on&nbsp;the&nbsp;bug&nbsp;related.<br />but&nbsp;it&nbsp;will&nbsp;take&nbsp;time&nbsp;before&nbsp;9.2&nbsp;will&nbsp;be&nbsp;available&nbsp;.<br />We&nbsp;will&nbsp;have&nbsp;to&nbsp;live&nbsp;with&nbsp;that&nbsp;for&nbsp;now.<br />Rolling&nbsp;back&nbsp;to&nbsp;those&nbsp;so&nbsp;much&nbsp;versions&nbsp;isn&#39;t&nbsp;a&nbsp;good&nbsp;solution&nbsp;I&nbsp;think.<br /><br />All&nbsp;my&nbsp;best.<br />Giliprled.<div style="clear:both;"></div>https://community.sophos.com/thread/143298?ContentTypeID=1Wed, 28 Aug 2013 09:26:39 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:0d2412cd-b905-4209-8fb8-71560add2c66bblankIt&nbsp;was&nbsp;working&nbsp;for&nbsp;me&nbsp;in&nbsp;8.309&nbsp;on&nbsp;6/7/2013<div style="clear:both;"></div>https://community.sophos.com/thread/143297?ContentTypeID=1Wed, 28 Aug 2013 09:20:00 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:dbde744b-32b7-4805-a7a6-2f6252215c10PaulHoltI&nbsp;rolled&nbsp;back&nbsp;to&nbsp;8.309&nbsp;(reinstall&nbsp;and&nbsp;rebuild)&nbsp;and&nbsp;the&nbsp;issue&nbsp;is&nbsp;there??[:S]??<br /><br />I&#39;d&nbsp;swear&nbsp;this&nbsp;worked&nbsp;at&nbsp;one&nbsp;point.&nbsp;&nbsp;Does&nbsp;anyone&nbsp;remember&nbsp;in&nbsp;which&nbsp;version&nbsp;this&nbsp;worked?&nbsp;[:$]<br /><br />Edit:&nbsp;I&nbsp;see&nbsp;in&nbsp;another&nbsp;thread&nbsp;this&nbsp;has&nbsp;been&nbsp;going&nbsp;on&nbsp;since&nbsp;well&nbsp;before&nbsp;8.&nbsp;&nbsp;I&nbsp;guess&nbsp;I&nbsp;wait.<div style="clear:both;"></div>https://community.sophos.com/thread/143296?ContentTypeID=1Sun, 25 Aug 2013 21:18:56 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:a0fc22f2-7683-4931-b738-de5d99e73414bblankThanks&nbsp;Jeff...&nbsp;you&nbsp;are&nbsp;correct&nbsp;-&nbsp;initial&nbsp;tests&nbsp;show&nbsp;undesirable&nbsp;results.&nbsp;&nbsp;Even&nbsp;applications&nbsp;like&nbsp;an&nbsp;Amazon&nbsp;downloader&nbsp;did&nbsp;not&nbsp;recover&nbsp;from&nbsp;the&nbsp;conntrack&nbsp;-F.&nbsp;&nbsp;I&nbsp;will&nbsp;look&nbsp;into&nbsp;the&nbsp;details&nbsp;of&nbsp;conntrack&nbsp;and&nbsp;be&nbsp;more&nbsp;&quot;surgical&quot;&nbsp;about&nbsp;the&nbsp;flushing.&nbsp;&nbsp;I&nbsp;will&nbsp;also&nbsp;look&nbsp;to&nbsp;see&nbsp;if&nbsp;changing&nbsp;timeouts/cache&nbsp;timeouts&nbsp;makes&nbsp;the&nbsp;firewall&nbsp;behave&nbsp;the&nbsp;way&nbsp;I&nbsp;would&nbsp;like&nbsp;for&nbsp;it&nbsp;to.<br /><br />Bob.<div style="clear:both;"></div>https://community.sophos.com/thread/143295?ContentTypeID=1Sun, 25 Aug 2013 10:59:45 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:87e46125-f562-4241-ac5b-3c17efff65fbjeff.wellingbblank:&nbsp;&nbsp;In&nbsp;theory,&nbsp;tcp&nbsp;connections&nbsp;should&nbsp;and&nbsp;likely&nbsp;will&nbsp;re-establish&nbsp;themselves.&nbsp;&nbsp;In&nbsp;the&nbsp;real&nbsp;world&nbsp;though&nbsp;things&nbsp;can&nbsp;be&nbsp;very&nbsp;different.&nbsp;&nbsp;I&nbsp;would&nbsp;advise&nbsp;being&nbsp;careful&nbsp;about&nbsp;deploying&nbsp;this&nbsp;to&nbsp;everyone&nbsp;right&nbsp;away,&nbsp;perhaps&nbsp;start&nbsp;with&nbsp;a&nbsp;smaller&nbsp;subset&nbsp;of&nbsp;users&nbsp;who&nbsp;opt&nbsp;in&nbsp;to&nbsp;trying&nbsp;this&nbsp;new&nbsp;tactic.&nbsp;&nbsp;<br /><br />Conntrack&nbsp;supports&nbsp;deleting&nbsp;specific&nbsp;connections,&nbsp;I&nbsp;propose&nbsp;you&nbsp;write&nbsp;a&nbsp;cronjob&nbsp;that&nbsp;dumps&nbsp;connections&nbsp;for&nbsp;that&nbsp;specific&nbsp;subset&nbsp;of&nbsp;&nbsp;users&nbsp;to&nbsp;measure&nbsp;the&nbsp;impact&nbsp;before&nbsp;deploying&nbsp;this&nbsp;widely.<div style="clear:both;"></div>https://community.sophos.com/thread/143294?ContentTypeID=1Sun, 25 Aug 2013 08:36:36 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:af24c61a-d21d-4362-b795-226f1a233369bblankAnybody&nbsp;care&nbsp;to&nbsp;pontificate&nbsp;on&nbsp;the&nbsp;values&nbsp;and&nbsp;detriments&nbsp;of&nbsp;adding&nbsp;a&nbsp;conntrack&nbsp;-F&nbsp;on&nbsp;an&nbsp;hourly&nbsp;or&nbsp;every&nbsp;30&nbsp;minutes&nbsp;through&nbsp;cron?&nbsp;&nbsp;&nbsp;I&nbsp;realize&nbsp;it&nbsp;would&nbsp;drop&nbsp;established&nbsp;connections,&nbsp;but&nbsp;wouldn&#39;t&nbsp;they&nbsp;just&nbsp;re-establish&nbsp;if&nbsp;there&nbsp;are&nbsp;no&nbsp;firewall&nbsp;rules&nbsp;to&nbsp;block?&nbsp;&nbsp;Then,&nbsp;time&nbsp;based&nbsp;rules&nbsp;would&nbsp;work&nbsp;as&nbsp;advertised.&nbsp;&nbsp;Thinking...<div style="clear:both;"></div>https://community.sophos.com/thread/143293?ContentTypeID=1Mon, 12 Aug 2013 20:12:45 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:7b7a334e-40cc-4895-8f94-a1e3c9718765BarryGHi,&nbsp;iirc&nbsp;they&nbsp;changed&nbsp;the&nbsp;license&nbsp;model&nbsp;late&nbsp;in&nbsp;7.5x&nbsp;or&nbsp;early&nbsp;in&nbsp;8.x,&nbsp;so&nbsp;your&nbsp;license&nbsp;will&nbsp;work&nbsp;in&nbsp;8.3x<br /><br />Barry<div style="clear:both;"></div>https://community.sophos.com/thread/143292?ContentTypeID=1Mon, 12 Aug 2013 18:58:18 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:a2f34fe4-770b-4513-9bec-458d80642744TheDrewHi&nbsp;InTheAir,<br /><br />UTM&nbsp;licenses&nbsp;are&nbsp;not&nbsp;version&nbsp;specific&nbsp;so&nbsp;you&nbsp;can&nbsp;upgrade/downgrade&nbsp;between&nbsp;versions&nbsp;as&nbsp;you&nbsp;need&nbsp;to&nbsp;without&nbsp;messing&nbsp;up&nbsp;your&nbsp;licensing.<div style="clear:both;"></div>https://community.sophos.com/thread/143291?ContentTypeID=1Mon, 12 Aug 2013 17:24:34 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:eaddf80f-fa77-4f9a-adc4-90209798f5fbPaulHoltWow,&nbsp;that&nbsp;is&nbsp;a&nbsp;long&nbsp;way&nbsp;off. <br /> <br />I&nbsp;guess&nbsp;I&nbsp;have&nbsp;to&nbsp;drop&nbsp;back&nbsp;to&nbsp;8.3....&nbsp;but&nbsp;my&nbsp;9.x&nbsp;license&nbsp;won&#39;t&nbsp;work,&nbsp;will&nbsp;it? <br /> <br />Paul <br /> <br />P.S. <br />I&nbsp;don&#39;t&nbsp;think&nbsp;this&nbsp;would&nbsp;be&nbsp;acceptable&nbsp;to&nbsp;a&nbsp;business&nbsp;using&nbsp;9.x,&nbsp;would&nbsp;it?<div style="clear:both;"></div>https://community.sophos.com/thread/143290?ContentTypeID=1Mon, 12 Aug 2013 10:04:39 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:a3e9ca52-d7fe-4d0f-baa6-a12a4f60a6fcgilipeledHi&nbsp;<br /><br />Yap&nbsp;,&nbsp;it&nbsp;will&nbsp;take&nbsp;few&nbsp;month&nbsp;probably.<br />And&nbsp;sad&nbsp;as&nbsp;it&nbsp;is&nbsp;this&nbsp;is&nbsp;the&nbsp;answer&nbsp;from&nbsp;them&nbsp;after&nbsp;we&nbsp;investigated&nbsp;it&nbsp;and&nbsp;the&nbsp;high&nbsp;level&nbsp;support&nbsp;has&nbsp;reproduced&nbsp;it&nbsp;in&nbsp;the&nbsp;lab.<br /><br />All&nbsp;my&nbsp;best.<br />Gilipeled.<div style="clear:both;"></div>https://community.sophos.com/thread/143289?ContentTypeID=1Mon, 12 Aug 2013 09:54:23 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:c74f9595-b548-4259-86a4-f2e950462de8caprocha<blockquote cite="gilipeled;241707">Hi&nbsp;, <br /> <br />Just&nbsp;to&nbsp;inform. <br />Mantis&nbsp;ID&nbsp;27685. <br />This&nbsp;is&nbsp;confirmed&nbsp;and&nbsp;this&nbsp;issue&nbsp;will&nbsp;be&nbsp;fixed&nbsp;in&nbsp;9.200. <br /> <br />All&nbsp;my&nbsp;best. <br />Gilipeled</blockquote> <br /> <br />9.2&nbsp;???&nbsp;[:(] <br /> <br />Probably&nbsp;expected&nbsp;only&nbsp;in&nbsp;2014&nbsp;on&nbsp;a&nbsp;stable&nbsp;GA&nbsp;release...<div style="clear:both;"></div>https://community.sophos.com/thread/143288?ContentTypeID=1Mon, 12 Aug 2013 08:56:46 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:97dda774-d091-4dfa-804c-9eff206f1517gilipeledHi&nbsp;,<br /><br />Just&nbsp;to&nbsp;inform.<br />Mantis&nbsp;ID&nbsp;27685.<br />This&nbsp;is&nbsp;confirmed&nbsp;and&nbsp;this&nbsp;issue&nbsp;will&nbsp;be&nbsp;fixed&nbsp;in&nbsp;9.200.<br /><br />All&nbsp;my&nbsp;best.<br />Gilipeled<div style="clear:both;"></div>https://community.sophos.com/thread/143287?ContentTypeID=1Mon, 12 Aug 2013 06:05:14 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:429d94d2-9de8-4912-9d45-d15eb8d32d9erfcat_vkLet&nbsp;me&nbsp;put&nbsp;on&nbsp;my&nbsp;old&nbsp;user&nbsp;hat.&nbsp;v5&nbsp;maybe&nbsp;v6&nbsp;I&nbsp;think&nbsp;this&nbsp;feature&nbsp;used&nbsp;to&nbsp;work,&nbsp;I&nbsp;tested&nbsp;it&nbsp;extensively&nbsp;then&nbsp;late&nbsp;v6&nbsp;the&nbsp;time&nbsp;blocking&nbsp;feature&nbsp;stopped&nbsp;working&nbsp;on&nbsp;existing&nbsp;sessions.&nbsp;<br />I&nbsp;reported&nbsp;this&nbsp;during&nbsp;a&nbsp;number&nbsp;of&nbsp;betas,&nbsp;but&nbsp;gave&nbsp;up&nbsp;as&nbsp;I&nbsp;had&nbsp;no&nbsp;further&nbsp;use&nbsp;of&nbsp;the&nbsp;feature&nbsp;and&nbsp;no&nbsp;seemed&nbsp;to&nbsp;care.<br /><br />Ian<div style="clear:both;"></div>https://community.sophos.com/thread/143286?ContentTypeID=1Mon, 12 Aug 2013 04:20:33 GMT4be5eb7d-caa4-4ff5-8e60-8f9463545a35:c9818343-2bea-4b24-be9b-817f55a1333bgilipeledHi&nbsp;,<br /><br />The&nbsp;problem&nbsp;is&nbsp;already&nbsp;reproduced&nbsp;in&nbsp;the&nbsp;support&nbsp;environment&nbsp;,&nbsp;working&nbsp;on&nbsp;investigate&nbsp;and&nbsp;solving&nbsp;the&nbsp;issue.<br />I&nbsp;will&nbsp;inform&nbsp;when&nbsp;I&nbsp;will&nbsp;have&nbsp;more&nbsp;info.<br /><br />All&nbsp;my&nbsp;best.<br />Gilipeled.<div style="clear:both;"></div>