Question for excepting certain destination on the web filtering

Question

Hello, 
 
 i want to configure a excepting a certain destination on the web filter. but i can't complete this configuration. 
 (Web filtering is in transparent. ) 
 So i tried to add the destination url on the "Skip transparent mode destination host/nets" following KB 120839. 
 community.sophos.com/.../120839 
 
 but exception is not working well. 
 
 For example, i want to except the google.com on the web filtering. 
 So i add the www.google.com to the "Skip transparent mode destination host/nets". 
 but when i access the google.com, http.log is generated regarding google.com. (action="pass") 
 It would be much appreciated, if anyone helps me to configure an exception on web filter.

BAlfson · Accepted Answer

You must uncheck 'Allow HTTP/S traffic for listed hosts/nets' underneath the Skiplists and make your own firewall rules for each of the listed destinations. 
 Cheers - Bob

Michael Dunn · Answer

Normally when you create a Web Filter profile and you specific the Source and Destination networks. This creates a behind-the-scenes firewall rule that says "If port 80 or 443 and this source and this destination, then send it to the Web Proxy for processing". When you select a destination in the transparent mode skiplist, then it basically modifies that hidden firewall rule so it does not apply to that destination. Assuming for a second that you have no other firewall rules, at this point if you try to create a port 80 connection to that destination, no firewall rules will match and the connection will be blocked. Now 99% of the time people who use the skiplist are doing so because they want to have allowed unfiltered access to that destination. They would then have to create their own firewall rule that then says Source LAN to destination (whatever it is you are going to) service HTTP/HTTPS then Allow. The checkbox "Allow HTTP/S traffic for listed hosts" basically does that for them. It creates a firewall rule that says that if they are in the skiplist, then port 80 traffic to that destination should be allowed. Anything that hits the skiplist will not go to the proxy. Therefore anything that hits the skiplist will not appear in http.log, however it will appear in firewall logs.

Michael Dunn · Answer

The result is different because you did not do as Bob suggested. Your traffic is allowed because you have the marked the checkbox "Allow HTTP/S trafic for listed hosts/nets" which creates a firewall rule for you. Uncheck the box. 
 
 Ultimately your problem is that you are trying to use a firewall rule to do the job of the Web Proxy. 
 If you are you are using the Web Proxy, and you trying to block port 80 traffic on certain hosts, it is much easier to get the Web Proxy to block instead of the firewall to block.