Connection to server timed out

I will assume that you are using Transparent Mode for web filtering.   If not, then the skiplists have no effect.

To skip these sites, you need to put the destination in the skiplist AND check the box for "Allow HTTP/S traffic for listed hosts/nets".   If you don't do this, the site might be blocked by the UTM firewall logic.

I have had difficulty getting Citrix to work with web filtering.  Stuff works fine for the login, but the process breaks down when it switches to ICA protocol.   Often, the switch to ICA also involves switching to a non-standard port.   I have gotten things working for one Citrix site by managing the login phase with web filtering, and manage the ICA phase with a firewall rule to enable the special port.

Hello Douglas,

I add the dns host to destination skiplist and check Allow HTTP/S traffic for listed hosts/nets but still not working. I attach screen if  I set up it right.

There must be the problem in web filtering. If I open same address from vpn on my home computer it's work like a charm.

1) Suggest you look for a DNS problem.   This document is helpful

https://community.sophos.com/products/unified-threat-management/w/utm-wiki/2/dns-best-practice

2) Try configuring your skiplist entries by ip address (with hostname configured as an attribute) and see if that works different.

3) Try disabling this setting:  Webfiler... Filter Options...  Misc... (scroll to bottom of page) Enable Pharming Protection

(I run with it enabled, but it causes an extra DNS lookup, so it may help diagnose whether or not DNS is the problem.)

Filip, since the solution suggested by DouglasFoster did not solve your problem and the access via VPN shows no such problem, I conclude:

1. Your Internal network is in 'Allowed Networks' for a Web Filtering Profile in Standard mode.
2. Your VPN subnet is not handled by httpproxy, and all traffic passes via firewall rule(s).

The solution is a GPO that makes client browsers skip the Proxy for Citrix access.  As DouglasFoster implied above, the 'Transparent Mode Skiplist' only applies in Transparent mode, not in Standard.

You might want to review Configuring HTTP/S proxy access with AD SSO.

Cheers - Bob

Filip, since the solution suggested by DouglasFoster did not solve your problem and the access via VPN shows no such problem, I conclude:

1. Your Internal network is in 'Allowed Networks' for a Web Filtering Profile in Standard mode.
2. Your VPN subnet is not handled by httpproxy, and all traffic passes via firewall rule(s).

The solution is a GPO that makes client browsers skip the Proxy for Citrix access.  As DouglasFoster implied above, the 'Transparent Mode Skiplist' only applies in Transparent mode, not in Standard.

You might want to review Configuring HTTP/S proxy access with AD SSO.

Cheers - Bob