Sophos UTM 9 - This site can’t be reached / took too long to respond / Connection to server timed out

Hi, Peter, and welcome to the UTM Community!

How does your DNS configuration compare to DNS best practice?

If that doesn't help, the first thing to try is an Exception for Antivirus scanning whenever you get a statuscode in the 500-range.  If that doesn't work, skipping the Proxy should.

Cheers - Bob

Hi,

BAlfson said:

 If that doesn't work, skipping the Proxy should.

I would alsao recommend you to put any bricks out of the way an then search for the error causing problem step by step...

so in my opinion - first step would be what BAlfson adviced.

Cheers,

Chris

I am having a similar issue, but only when the device is in the transparent host list, or I turn off the web proxy.  Masq and Firewall rules are set to allow all traffic out of the house.  If the proxy is used, it works flawlessly.  If I add the computer to the transparent host list, then some sites work and some don't.  It is almost like DNS requests are not getting sent unless the device is in the web proxy list.  This just started happening with 9.501 and is happening on 9.502.  Also, I have noticed considerable lag in Live Log for the Firewall.

Arghh!!! Not another 9.5 bug!  Everyone should stay on 9.413 for the time being!!!

Cheers - Bob

I'm confused by your comment about DNS requests...

In Transparent mode, all DNS requests are made by the browser before the browsing request is sent through the UTM, and the Transparent Proxy makes none.  In this mode, the Transparent mode skiplists determine which traffic skips the Proxy.

In Standard mode, the browser doesn't request name resolution, the Proxy does.  In this mode, the 'Exceptions' in 'Proxy Settings' in the Browser determine which traffic skips the Proxy.

If the Default Profile is your only Profile and it is in Transparent mode, it will react as if in Standard mode if the browser sends a port 8080 request to the IP of "Internal (Address)" instead of resolving the FQDN itself and sending port 80 traffic to the website address.

If 'Automatically detect settings' is selected in the 'LAN Settings' of the browser, it's likely that the browser is addressing the Proxy in Standard mode, so do not select 'Automatically detect settings' if you want to use Transparent mode.

Cheers - Bob

I said DNS, only because it is the first part of the process and the error comes back as the OP described.  I don't think DNS should be to blame, so I just manually changed the DNS to be google on the computer, and watched a custom firewall rule, and it did hit.  However, the browser still displayed this same message the OP posted even though the firewall rule just below the DNS rule, says to allow all outbound traffic from any port to any IP from any internal IPs.  It seems to happen when I add the computer to the transparent source skip list, or turn off the web proxy all together.  If I go with the transparent skip list, ALL ports that were covered by the proxy just seem to blackhole.  I can still RDC out of the house, but 80,81,8080,443 traffic goes to lala land.

If I turn the proxy all the way off, in about 5 minutes, traffic starts flowing again (but makes the original problem that led me to discover this even worse).  If it is in the transparent skip list, it never came back in my testing EXCEPT if the website was open before the computer was added to the skip list.  If I have gmail open when I add the computer to the skip list, it gets new responses from Google just fine.  If I punch up speedtest_dotnet, it would time out and say host not found.  Some sites randomly worked but i think it is because they had keep-alives from advertising or other computers on the network.

This is a weird one, and it was all set off for because stupid Blizzard changed their client and now it doesn't work with the UTM for the first time in years.  When I tried to debug their problem, things just got stranger and stranger.  All of their sites were already in exceptions, and most of their content delivery was in the destination skip list (why it was working the last 3 years).  Based on a brief investigation with Wireshark and Fiddler, I believe Blizzard is trying to use some TLS trickery to verify that you are a legitimate client.  Problem is, I see the traffic leave my computer, but I never see it at the UTM, so at some point in the process, the UTM is silently dropping these extra packets. They aren't showing as a default drop, and they won't display in any firewall, web proxy, or dnat created rule no matter how much I try.  I shouldn't be playing games anyway right now so I am dropping it, but to make this seem even weirder, the app worked better when I took the hosts out of the destination skip list.  It still failed, but it was further along in the process when it did.

Sorry for the rambling, I have been up for 38 hours (The last 12 dedicated to this).

Good Evening,

Thank you for your reply and sorry for my delay.

#1 to #4 of best practice is correct on UTM will look 5# to 8# when i get back in work and report back.

Thanks again for all the help.

Peter

I have left this job now and can no longer give a right or wrong answer to this solution.