Sophos Community,
Let me begin by saying that I can be very long winded and don't normally post in general so if this is in the wrong place on the forum or includes too much information please excuse me.
Let me begin with the "Long version" as it contains what I consider to be pertinant details about my network and situation.
Long Version
I am new to Sophos but not new to networking or the search for an excellent offering as an open source or Home edition UTM. I have used Dansguardian, PFsense, ipcop, Mikrotik, Shade (what a joke), and Untangle. So far my favorite simply from ease of use is the Untangle software but it does not offer as much as the Mikrotik can if you know enough or that Sophos offers out of the box and espically if you consider its potential.
My network is as follows. I work for my ISP and we have fiber terminated at the office which then gets rebroadcasted via wireless to my home. From there the "modem" or "radio" which is completely bridged is plugged into the external interafce of my Sophos box which is an old repurposed Dell. I believe I bought it in '06 but that could be off, either way it has more than sufficent hardware to run just about any offering you can think of in this case and sports a 1TB drive. From there I have a secondary NIC that goes through standard ethernet to a Netgear EoP (Ethernet over Power, it uses the existing power lines in the home to bring the signal to its twin in another part of the house) Out of the second EoP it goes to standard ethernet to Eth1 on my RB2011UAS-2HnD-IN which currently only serves to wireless clients via its 1000mw radio card.
Through this setup I can pull my full speed that I get from the shop of 15Mbps at about any given time unless I enable download throttling or any QoS. My Mikrotik is completely bridged, the clients get DHCP form the Sophos UTM. 9.100-8 with an update pending.
To begin I have a few examples of issues that I struggled with handling with my Sophos setup.
1. Xbox Live
Like many home networks I have an Xbox360 and other gaming systems. So far I have only tried tackling the 360. As I am sure most of you are aware for optimum performance on the Xbox Live servers a few specific ports have to be open.
- Port 88 (UDP)
- Port 3074 (UDP and TCP)
- Port 53 (UDP and TCP)
- Port 80 (TCP)
Reference Here --
http://support.xbox.com/en-US/xbox-live/connecting/network-ports-used-xbox-live
Initially after adding rules in my firewall I was not able to get the fabled "Open NAT". I even tried an Any to Any to Any rule as rule 1. (With which I was still dropping a ton of packets and not only on the aforementioned ports... I diasabled all of the other filtering services and still saw the same issue) It was only after finding another forum (or perhaps it was a post on this forum I forget) that showed me how to use the DNAT rules for NAT that I was able to make sure that the traffic was handled properly and allowed the ports to be opened up so that I could have Open NAT.
2. Ultrasurf
Let me begin by saing that I acknoledge the difficulties involved in blocking this program and other programs of this type. My main goal is to discourage use of this program entirely from the network level. I do not believe in the lost cause of blocking Untangle but that is not the reason for this post.
In an attempt to be brief I will boil this down some. Ultrasurf creates a proxy on the localhost using port 9666 which that traffic never sees the network level. From there using HTTPS it establishes a secure connection to one of its many IP's out of at least 2 known networks.
65.49.0.0/17
204.107.140.0/24
Reference Here --
http://wiki.mikrotik.com/wiki/How_to_Detect_and_Block_UltraSurf_program_traffic
I defined both networks as Ultrasurf1 and Ultrasurf2 respectively. I would think that if I put in a rule that said Source: Ultrasurf1 using HTTPS (Or Any) going to Internal Network (or External IP) and visa versa that all traffic...at the very least on those networks...would be killed. Well I have 12 individual rules, one for each of the above going both ways and I can still go to www.whatismyip.com while using Ultrasurf and be on the first network...it does not even stumble.
3. Web Filter
I blocked Uncatagorized web pages with the web filter and it blocked some local pages (to be expected) but when I added them to the Always Allow URL list they were still blocked....what gives?
Those are all of the Examples I have.
Short Version
Questions
1. How does NAT effect my firewall rules? Will I always have to change my NAT to make some rules work?
2. Is Sophos a Top Down filter? I had read that it was and it seems to be but I put in that Any to Any to Any rule as rule 1 and disabled all of the other services and still had no Open NAT and was dropping packets left and right (on the Firewall Open Log).
3. Is the Firewall broken or am I missing something? If I make a rule that says no traffic allowed from this source network or to this source network using any service to both the Local Network and the External IP, how in the nine hells is it still going?
4. Do grouped rules work well? Again my understanding fo the firewall is that the first rule that matches is the rule that is used in a top down order. So can I group source and destination and services together to eliminate multiple rules where 1 or 2 would work just as well or is there a good reason to split them up? Will using more rules slow down the Filter?
5. What is the color coding for? I can't find any documentation for this. I assume it is to tell the administrator "used", "being used", "never used", or other things like that to tell the admin how effective the rules are.
6. I have what I consider to be some pretty strict settings against people who would try and get around the filter which is currently my main focus.
- Anonymizers
- Anonymizing Utilities
Are both being blocked by the Web Filter, all VPN, P2P, and Proxy services are blocked in the Application filter, and I have a few generic rules in my firewall to prevent Ultrasurf at the moment. And I have succeeded in blocking programs like ProXPN (a VPN tunneler to anonymize traffic) with Sophos but for me if you can do a 5 Min Google search, find Ultrasurf, and dodge the filtering, then all of that work is for nill. So my question, What more can I do? Is there a way to do MIME types or Add signatures for application (layer 7) filtering? As I understand it Smoothwall and SonicWall and other solutions block it pretty easily yet I can find no documentation or manage it myself.
Well I have more questions but I had better call it a day. Sorry if there are any spelling or grammical errors, I typed this up once already but tried to submit it and got an Authentication Ticket invalid or some crap and had to retype it all again....
Thanks for anyone who took the time to read this and double thanks if you respond with advise!
Bergie
This thread was automatically locked due to age.
