RE: Webserver protection setup problems

BAlfson — Mon, 12 Aug 2019 20:34:11 GMT

Hi Scott and welcome to the UTM Community!

Do you see anything in the WAF log that would indicate that it's processing the incoming requests? Please show pictures of the Edits of the Interface definition, the Virtual Server, Real Server and the Host object in the real server.

Cheers - Bob

RE: Webserver protection setup problems

DouglasFoster — Sun, 11 Aug 2019 18:29:48 GMT

1) I do not believe that you do not have bridge mode. Bridge mode looks like this:

Switch --- UTM --- Firewall

Two (or more) physical interfaces are bound together as one logical interface to UTM. Everything going to the firewall has to pass through UTM.

From your description, you have this:

Switch --- UTM
\____________ Firewall

In this mode, UTM only sees traffic that targets one of its addresses, so it can only do Standard Mode functions. For more detail on Standard and Transparent mode functions, see this post:

https://community.sophos.com/products/unified-threat-management/f/general-discussion/100848/how-to-understand-utm-port-usage

2) Basic process that I use for configuring a webserver:

On UTM

Configure the real webserver and test it internally
Get an SSL Certificate for the website so you can use HTTPS, which provides proof of server identity as well as encryption.
Configure an Additional Network Address on UTM. (Using the primary address will create conflicts with the user portal.) Since UTM is behind your firewall, this will be an internal address.
Create the virtual webserver and assign it to the chosen IP address and the (recommended) SSL certificate.
Enable the webserver. If it can connect to the real webserver, the status indicator will go green. (May need to navigate away and come back to see the correct status light.)

On a test machine with an internal IP address

Create a HOSTS file entry to force your test traffic to target the UTM virtual webserver address instead of the real webserver address.
Enable a firewall profile with all protections enabled but in monitor mode.
Do all of your tests
Review the logs and disable tests that are throwing false positives.
Decide whether to deploy to the internet in Monitor Mode or Reject Mode

On the firewall

Create a NAT rule from the chosen Internet address to the UTM virtual webserver address.
Test again from an external PC.
Enable Reject mode