This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Protection Decrypt and Scan break VPN Connection

Hello,

I have my Open VPN Client configured Router in a DMZ, and route all traffic from LAN over this Tunnel.

I have the setting Web Filtering - HTTPS - URL filtering only, this works.

When I change the setting to Decrypt and Scan, the VPN Tunnel disconnects, and the Open VPN Log on the Router show Client Wait , Reconnect , Tls Errror.

What do I have to configure, to use Decrypt and Scan setting ?

Thx

This thread was automatically locked due to age.

0 sachingurung over 7 years ago

Hi Sally,

Any help, after configuring an Exception Policy to skip HTTPS Scanning for the request coming from the VPN tunnel network addresses?

Thanks

Sachin Gurung
Team Lead | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasFoster over 7 years ago

To elaborate on sachingurung's point, the two technologies are inherently incompatible, so you have to ensure that https inspection is off when VPN is on. An exception for the VPN target server should allow https decrypt-and-scan to be enabled for everything else.
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 7 years ago

Perhaps you can omit the DMZ network from web filtering (depending on whats all in your DMZ) and only use webfiltering on your Internal LAN. That way its highly unlikely that the https traffic from the OpenVPN client is intercepted by the decrypt and inspect policy.

Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sally over 7 years ago in reply to apijnappels

Hello,

thanks I will try with exception, and test this out.

best regards

Sally
Cancel
Vote Up 0 Vote Down

Cancel