Quantcast
Channel: Sophos User Bulletin Board
Viewing all articles
Browse latest Browse all 14361

Help Understanding Firewall Block Rules

$
0
0
Environment:

test_vm (192.168.0.123)
astaro (192.168.0.1)

Goal: Block incoming traffic from a specific internet IP. For this example, I'm using HTTP traffic to keep it simple, but it could be anything)

If I setup a rule as follows:

source - test_vm
services - http (src_port 1:65535; dest_port: 80)
destination - internet
action - reject

Web browsing is blocked and I can see the page requests being blocked in the firewall log (this is expected).

If I reverse the rule (to block the responses, not the requests)
source - internet
services - http response (src_port 80; dest_port: 1:65535)
destination - test_vm
action - reject

Web browsing is fully functional and the firewall doesn't stop the traffic. This same behavior occurs with other traffic such as DNS reponses as well. Can someone explain to me why this is? As far as I can tell, that rule should block all traffic originating from port 80 to my test_vm.

Viewing all articles
Browse latest Browse all 14361

Trending Articles