Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 9 replies
  • Subscribers 2 subscribers
  • Views 25082 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unblocking game or application traffic

nyc2mia
Hi, folks,

Sometime this week, Electronic Arts released a major update for Real Racing 3, but the game files are being blocked. We can play the game, save and restore online progress, and even see some intermittent download progress, but we can't complete the downloads for new/updated tracks or cars.

I can confirm that the problem is with my UTM configuration and not EA's CDN, because the moment I switch over to my wife's business SSID, downloads scream through. As soon as I switch back to my residential SSID, I get errors stating that the game files weren't downloaded. Speedtest shows very little latency and good bandwidth, and everything else seems to work fine, so I doubt it's the network.

I'm pretty sure I need to create some exceptions, but I don't know which [live] logs to look at, to determine what's being blocked and why. I did find a report that shows 20 GB was passed from eamobile.com, and 1 MB was blocked from the same site; however, I can't tell why it was blocked:



Please help! I've been searching for hours, and I can't find anything that shows how I can use all these wonderful tools to figure out how to make my son's game work on my network again.

Any and all suggestions will be welcomed!


This thread was automatically locked due to age.
  • 0
    This seems to be the live log of the web proxy [;)]
  • 0 in reply to FrankBarmentlo
    That's actually a snippet from the New Custom Report screen (Logging & Reporting | Web Protection | Web Usage Report tab).

    The problem is that I don't know what to do with that information. I can see where it says that 1 MB was blocked, but I can't drill down to see why it was blocked or click to allow it. The site has been categorized as Games, which I'm allowing, so it must be tripping a different rule (firewall, A/V, IPS, file extension, etc.). I just don't know how to figure out what's being tripped, so that I can adjust it.

    If I could see all traffic from/to a specific host (i.e. the mobile device), it might help me determine what was blocked/rejected/dropped and why. I just don't know how to find and filter for that information. That's the first obstacle. The next obstacle will be figuring out how to adjust the necessary rules to allow the blocked traffic/content.

    UTM 9 Home Use

  • 0
    Check the actual Web Filtering log.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    It's the web filtering log,
    Here you can see if it is blocked, and also why.

    Logs can be found under "logging & reporting"  > view logs
    there' s a whole list of modules and parts of the UTM that have logs.
    Web Filtering is at the bottom of the list (2nd from bottom).

    Behind every log there' s 3 buttons:
    "Live log": Shows what is being logged from the moment you opened it - keep in mind that it has less useful information in most cases then the full log.
    "View": Clicking here opens the full log from the chosen module
    Clear: Clears the log

    If you go to web filtering, and click on the "view" -button behind it, it will open a new window.
    just hit ctrl-f, seatch for the domain in your first post and copy the lgo entries to a new post in this topic.

    an example of such a log entry is this:
    2015:10:22-00:01:40 snowleopard httpproxy[27629]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.7.2" dstip="87.110.183.174" user="" ad_domain="" statuscode="504" cached="2" profile="REF_HttProConta4Inter4 (5. Servers v.1)" filteraction="REF_HttCff5Servers (5. Servers)" size="0" request="0xd705e000" url="repo.zabbix.com/.../Hardware"

    Keep in mind yours might look different or have different values [;)]

    From there we can help you reading the log and figure out what goes wrong.
    Kind regards,
    Frank
  • 0 in reply to FrankBarmentlo
    Thanks, Frank,

    Now that's what I'm talking about! [:D] There's some serious info available! Unfortunately, the downloads eventually completed, so can't do any more testing [possibly] until another update; however, I'd still love to figure out what went wrong, so that I can avoid it in the future.

    Here's a 15-second snapshot of my Web Filtering log: 

    2015:10:21-15:51:15 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="70" request="0xde1e7000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:15 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2255" request="0xdfa94000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:19 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="70" request="0xddd01800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:23 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="40723" request="0xdfb68000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:23 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xe2768000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:25 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xde1e6000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:25 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xdfb69000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:25 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xdd125800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:25 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xe1898000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:26 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xdd127800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:26 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xde5e9800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:26 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xe06ba800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:26 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xe06ba000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:26 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.1.105" dstip="69.31.132.26" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="17632297" request="0xdcf53800" url="cdn.adc.eamobile.com/.../octet-stream"

    2015:10:21-15:51:26 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.1.105" dstip="69.31.132.26" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="17632297" request="0xe1669800" url="cdn.adc.eamobile.com/.../octet-stream"

    2015:10:21-15:51:27 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="192.168.1.105" dstip="23.23.143.164" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="7373" request="0x97dc000" url="services-v2.artisantools.com/" referer="" error="" authtime="2" dnstime="342551" cattime="403" avscantime="0" fullreqtime="61820982" device="3" auth="2" ua="" exceptions="" category="105" reputation="neutral" categoryname="Business"

    2015:10:21-15:51:27 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="155340" request="0xdd230800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:27 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="166055" request="0xdfb68800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:27 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="18749" request="0xde1e4000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:27 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xde1e5000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:28 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="14909" request="0xdfb68000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:29 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2255" request="0xe189f000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:29 utm httpproxy[31919]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2667" request="0xdf046000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:29 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="28670" request="0xdf8f5800" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:29 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.1.105" dstip="69.31.132.26" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="17632297" request="0xde34b800" url="cdn.adc.eamobile.com/.../octet-stream"

    2015:10:21-15:51:30 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="24904" request="0xa167000" url="0037-assets.cloudcell.com/.../html"

    2015:10:21-15:51:30 utm httpproxy[31919]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="192.168.1.105" dstip="50.97.159.156" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="8722" request="0xdfa04800" url="0037-assets.cloudcell.com/.../html"


    Things get a little confusing between the 15 and 23-second marks, where the same .PHP URL that's being sent through starts getting blocked, then (just a few seconds later) starts getting passed and then blocked again.  [:S]

    Furthermore, it looks like the actual .BIN game files are being allowed through, but the game's download progress monitor was just stuck.  If I cancelled the download and then started it again, it might advance a 10th of a percent, when it normally completes an entire download in a matter of two to three seconds.

    I'd appreciate any insight you might be able to provide!

    UTM 9 Home Use

  • 0
    Some long-ish fullreq times, possibly due to latency.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    Please note that some "block" are actually errors - has to do with how log are parsed.

    Take a look at the error=.  There are several "Connection reset by peer" which basically means that the UTM found that the connection was closed (not by itself) while it was waiting for traffic.

    Why that occurs, no one knows for sure.  But the far end (eg server) closed the connection.

    Aside from that you are getting dnstimes that are 200-700 milliseconds and it appears like the answers may not be locally cached.  Other people are DNS configuration experts, but (possibly not related) you've got some DNS problems.
  • 0
    statuscode="502" might be solved by creating an Exception for Anti-Virus for^https?://0037-assets\.cloudcell\.com/.  If that doesn't solve your problem, then skip the Transparent Proxy for a DNS Group for 0037-assets.cloudcell.com.  Any luck?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi, Bob,

    I had missed the last couple of postings - maybe they came in during the forum software transition??  Anyway, I'm glad I came across this now, because you were right on!  [Y]

    I created a few AV/Extension/URL/content/SLL exceptions (just to be safe), and the game assets started downloading.  Here's some of what it looks like I had to let through:

    Here are the exceptions I created:

    • ^https?://([A-Za-z0-9.-]*\.)?cloudcell\.com/
    • ^https?://([A-Za-z0-9.-]*\.)?ea\.com/
    • ^https?://([A-Za-z0-9.-]*\.)?tnt-ea\.com/
    • ^https?://([A-Za-z0-9.-]*\.)?eamobile\.com/
    • ^https?://([A-Za-z0-9.-]*\.)?cloudfront.net/

    Something tells me my expression syntax is wrong, but I'm happy, because the asset downloads did manage to complete.  The downloads weren't as fast as they are with web filtering disabled, but they did complete.  I'll look up the proper regex syntax, to see if correctly formatted exceptions help the download speeds.  [^o)]

    Regards,
    Edgar

    UTM 9 Home Use

Unfiltered HTML