Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 2150 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Transparent Proxy/Block IP Range?

KLambert
We're using 7.305. 

I'm trying to block port 80 to a range of IPs after a recent keylogger incident (thankfully not my network but a related one). I have the ports blocked in the packet filter for the service "any" and that works fine, but it seems that the transparent http proxy overcomes the packet filter and allows the traffic.

So how do block port 80 to an ip range while continuing to use the transparent proxy?


This thread was automatically locked due to age.
Parents
  • 0
    An internal range of IPs, or an external one like one in China?
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    If you're trying to block a range of Chinese, like the jerks who've been hammering us with break-in attempts (221.224.78.224 - 221.224.78.255) for the last few weeks, then I have a suggestion, but I haven't tried it.

    [LIST=1]
    • Create a network definition

      Name: Chinese Hackers
      Address: 221.224.78.224
      Netmask: /27


    • On the 'Web Security >> HTTP' 'Advanced' tab, add 'Chinese Hackers' to the 'Transparent mode skiplist'.

    • Create a packet filter 'Drop' rule

      Source: 'Chinese Hackers'
      Service: 'Web Surfing'
      Destination: 'Any'


    [/LIST]

    If you don't need to use the 'Transparent mode skiplist' to allow unproxied traffic to something like off-site servers, then you can probably dispense with the packet filter rule and just make sure the 'Allow HTTP traffic for listed hosts/nets' box is not checked.

    I'd be interesteed in knowing if that solves your problem.

    Cheers - Bob
    PS It's the end of the day, and I might have Source and Destination reversed on the PF rule.  Time to quit for the day.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0 in reply to BAlfson
    If you're trying to block a range of Chinese, like the jerks who've been hammering us with break-in attempts (221.224.78.224 - 221.224.78.255) for the last few weeks, then I have a suggestion, but I haven't tried it.

    [LIST=1]
    • Create a network definition

      Name: Chinese Hackers
      Address: 221.224.78.224
      Netmask: /27


    • On the 'Web Security >> HTTP' 'Advanced' tab, add 'Chinese Hackers' to the 'Transparent mode skiplist'.

    • Create a packet filter 'Drop' rule

      Source: 'Chinese Hackers'
      Service: 'Web Surfing'
      Destination: 'Any'


    [/LIST]

    If you don't need to use the 'Transparent mode skiplist' to allow unproxied traffic to something like off-site servers, then you can probably dispense with the packet filter rule and just make sure the 'Allow HTTP traffic for listed hosts/nets' box is not checked.

    I'd be interesteed in knowing if that solves your problem.

    Cheers - Bob
    PS It's the end of the day, and I might have Source and Destination reversed on the PF rule.  Time to quit for the day.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
Unfiltered HTML