internal Proxy Usage from other (DMZ) Networks

Hello community,

I have a problem understanding  the usage of the internal UTM (9.4) proxy from other UTM Networks.

My setup:

• Internal LAN (192.x)
• DMZ Server (172.16.1.x)
• DMZ WLAN (172.16.2.x)

 The Web Protection is enabled:

•  allowed Networks: internal only
• Standard mode
• AD SSO Authentification
• block accees with no athentification enabeld

 All other Networks are in tranparent mode with different guidelines

 I have no additonal Packet Filter rules in the two DMZ Networks, only DMZ ->allow-> DNS, everything is handled by the proxy

 I have no additional surfing (http/https) rules for the internal LAN (everything  is handled by the proxy)

 And here it comes:

 I worked on a Server in the DMZ Network and wondered if the Server can Access the internet without a DNS packet Filter rule….

 I attemped to connect to an internal WebServer and it works…

 I couldnt believe it and i checked the Server proxy settings and i saw that a colleague has setup the internal proxy settings (192.168.x.x Port 80xx) to the DMZ Server (172.16.x.x)

 This makes it possible to surf and connect to the internal Server….without any rule or other settings….(DNS, etc)

So how can i prevent the usage oft the standard internal Proxy (192.) from other Networks ? I thought the Web Protection allowed Networks is the key, but it isnt…

BG

mwie