What traffic does the web proxy intercept?

Question

What traffic does the UTM web proxy intercept? Before you jump with the answer http TCP 80 & https TCP 443, I came across an entry blocking a TCP 8250 eg https://host.anotherdomain.com:8250 and wondered how it actually detected this as it was clearly not on port 80/443. I only noticed this using standard mode and didn't notice it using transparent mode (although I may have missed this in the past)

This thread was automatically locked due to age.

DouglasFoster · Answer

In Standard Mode, a compliant web browser says "proxy, please fetch this for me". This allows Standard Mode to process traffic on any port number. (It also allows for better user attribution for https traffic.) The UTM configuration blocks all non-standard ports by default, so you need to monitor the logs to decide what additional ports you want to permit. (Filtering Options... Misc... Allowed Target Services) 
 I say "compliant" browser, because nothing guarantees that any software on the client will actually use the configured Standard Mode proxy. So you want to leave Transparent Mode enabled as well. 
 Transparent Mode does not recognize that a packet is in HTTP/HTTPS format, it simply assumes that if the traffic is on ports 80 or 443, then it must be http(s) and it activates its logic. I don't think the Transparent Mode does anything with the additional ports list. 
 As discussed elsewhere, Chrome's browser, with the QUIC protocol enabled, tries the following sequence: 
 
 UDP 443 with Standard Proxy, which is blocked by default at UTM 
 UDP 443 without proxy, which will hit the Firewall Rules and bypasses all web proxy functions 
 TCP 443 with Standard Proxy 
 TCP 443 without proxy, which will hit the Transparent Proxy. 
 
 To ensure that Chrome traffic goes through your proxy, you need to add UDP 443 to the additional ports list or block UDP 443 at the firewall. 
 More generally, my goal is to identify all legitimate sources of UDP traffic, configure firewall Allow rules for them, and block everything else on UDP. UDP is ideal for malware that wants to hide in plain site. I got started on this analysis, then got distracted onto other things.