Multipath rules: Block specific traffic for an interface

Hi,

By default, allowing web services will also allow YouTube streaming, we cannot explicitly define the block through multipath rule.

Configure an application control policy to block YouTube Streaming and turn it on when the internet does a failover.

Thanks

Hello and thanks for replying!

Also apologies for my late reply (was on family vacation)

So, following your advice, I created a new rule with the following:

I wanted to block torrents and media streaming while on 3g

Does it look sufficient for my purpose?

Specifically for the source networks, I added all entries regarding my 3G interface. Would entering only 3G Network (and ommiting 3G address and broadcast) suffice?

Thanks again for your help!

Hi,

I hope you enjoyed the vacation :)

As I mentioned in my previous post, gateway based application blocking is not possible. But, I wonder if that configuration shall do the job! Please update us if it works.

Thanks

Hi,

I hope you enjoyed the vacation :)

As I mentioned in my previous post, gateway based application blocking is not possible. But, I wonder if that configuration shall do the job! Please update us if it works.

Thanks

Hello again!

Vacation was really nice, thanks for asking!

I thought that's what you meant on your previous post - unless you meant a global application rule to block streaming and torrenting that I will manually turn on when on 3G.

But manual switching is not an option, as I may be out of the house the moment this happens and/or may not see the warning emails on time. (And even if I do, accessing the webui, turning on the rule, and then back off when the ADSL line is up again, is not a very neat solution [:P] )

I can't test it right now, but crossing fingers that it will work.

Once I am able to test it I will update the topic

OK, later update: Not working...[:(]

The applications are being blocked only if I put any in the source networks.. I even tried to trick it by creating a rule to block youtube using any as the source networks and then adding the external interface in the exception list, but that didn't work either....[:S]

Any more ideas?

Please show also the other active Multipath rules above the Any-Any-Any rule you inserted in the post above.

Cheers - Bob

Hello, Bob! Thanks a lot for trying to help!

Actually that rule is number 4 now (had something else that is deleted now)

So all rules in order are:

1. Allow web surfing to all interfaces

2. Allow torrenting on External (ADSL) interface

3. Allow streaming media on External (ADSL) interface

4. And finally the any rule

The interfaces are set up as follows:

Thanks again!

I would put these in a different order: Torrenting, Streaming Media, Web Surfing & Anything else.

Any better luck with that?

Cheers - Bob

Hello again, Bob!

I actually thought about this myself, too, after watching my previous post (lol), but haven't got the chance to try it out, yet.

I will update the thread when I manage to test that.

Thanks again!

Hello again!

Update on the subject:

I finally managed to test by having the multipath rules this way, Bob..

So I now have Torrenting, Streaming Media, Web Surfing and then Anything else

Unplugged the ADSL line, the 3G Interface came on from standby, but Youtube videos were still accessible (rather slow, though, because as an ultimate resort to conserve data I have set the 3G to 1Mbit max up/down)

Also dropping a torrent started to download immediately

So, unfortunately, this solution does not work, either....

Any other ideas you may have are very welcome!

Cheers!

Hi,

As I can see the alignment of the multipath rule doesn't work. I was curious when you came up with the work around like this.

I would suggest you to raise this as a feature request at http://feature.astaro.com .

Out of the box, this feature is available in Sophos's latest SF-OS devices called XG and interestingly SG devices are compatible with the new OS.

Thanks

Hello again, and thanks for the suggestion..

However there are a lot of feature requests with much higher interest for many which are not fulfilled yet. So I doubt this will ever make it to a sophos release.

I am using a home licence and have sophos installed on a PC.

If the XG has that feature this is interesting. However, TBH, I already gave it a try in a virtual machine and I don't like it. I found it all over the place. [:S]

I read there are also stuff included in the UTM that are not yet available on XG.

So I am sticking with the UTM until XG matures enough, or at least when a migration tool is created...