Sky Q reports broadband connectivity issues with UTM (home) used as router.

Question

In my home network I've recently attempted to replace my aged netgear router with a small PC running the UTM Home code. Actually, I have succeeded except for the Sky Q satellite receiver. The setup is OpenReach Modem --- Sophos UTM --- Netgear Gigabit switch 1 --- Netgear Gigabit switch 2 --- Sky Q box /// all connections are wired ethernet. 
 The problem is that the Sky Q box reports that I have problems with broadband connectivity and many of the network based interactive services do not work, although I can download firmware updates and also trigger video downloads from the Sky website. I can also access YouTube (lucky me). 
 I have set up firewall rules to allow the Sky box access to all internet sites using all IP protocols, and also allow all external access to the box from the outside (not a situation I want to maintain). I have turned off all protection except the firewall and some POP3 email scanning. If I replace the Sophos UTM device with the old netgear router the sky box works perfectly. 
 I'm at a bit of a loss as to where to go next. Has anyone else done this or does anyone have any ideas what could be causing the problems? 
 Thanks,

BAlfson · Accepted Answer

Hi, Len, and welcome to the UTM Community! 
 Just FYI, the version you're using is the identical code to what is used in businesses. The free home-use license just has limitations in the number of connection, IPs protected and customization. 
 Good job of finding that suggestion. #1 in Rulz is often helpful. 
 As you've discovered, the "Any" object only includes TCP and UDP - not any other IP protocols. I've only used the "Traceroute" and "Ping" objects. I haven't tried making an "ICMP" Service definition with IP Protocol 1, but that might do what you want. Please let us know if you try it and WebAdmin liked it. 
 Cheers - Bob

BAlfson · Answer

(Still chuckling.) Great attitude, Len. You're obviously a lot smarter than you let on! 
 The UTM firewall lets nothing pass either way by default - all traffic is blocked unless explicitly allowed. There is normally no reason to create a Block rule. 
 When you first configure the UTM, the Installation Wizard makes some manual firewall rules based on your selections. When you enable Web Protection and configure it, WebAdmin makes invisible firewall rules, and the same is true of other proxies and for things like the User Portal. With VPNs and NAT rules, you have the option of selecting 'Automatic firewall rules' which can be seen at the top of the list in 'Firewall'. 
 Unlike the firewall you're accustomed to in Windows, the UTM firewall is "stateful." It uses a connection tracker that allows in responses to requests that were allowed out. For this reason, you don't need to worry about allowing/blocking anything coming in from the outside. 
 Pleasant dreams. 
 
 Cheers - Bob

BAlfson · Answer

"Of course, the thing was actually pinging the gateway! Setting the destination of the rule as Internal (Address) rather than Any gave me exactly the behaviour I wanted - the gateway will now respond to ping packets only from the Sky box." 
 Len, this is true for the same reason as #4 in Rulz : for a Traffic Selector to apply to packets with a destination of an IP on the UTM, the corresponding "(Address)" object must be used. Under the covers, it's iptables that does the work. Using "Any" or a normal Network/Host definition causes the Traffic Selector to apply to packets in the FORWARD chain. The "(Address)" objects are bound to the interface on which they're defined, so that causes the Selector to apply to the INPUT chain. 
 To see which Services the Sky box uses, look at the "Top services by client" on the 'Bandwidth Usage' tab in 'Logging & Reporting >> Network Usage'. 
 If I were to guess, I'd say that the Chinese military has 1,000+ brilliant engineers making/running thousands of computers trying to break into every IP in the world. They don't just spy on our government and military, they also target intellectual property. Everyone needs the kind of protection a UTM offers. 
 Cheers - Bob