topic Re: SMB Access Policy Control and internet access in Spark Firewall (SMB)

SMB Access Policy Control and internet access

David_C1 — Thu, 04 May 2023 19:19:38 GMT

I'm stuck why this doesn't work, but basically I'm trying to allow devices connected to the LAN network of my SMB device access to the internet over certain ports.

Background: Locally managed 1430 appliance running R77.20.87

Access Policy (Firewall) is set to strict.

I've created a manual rule in the policy to allow internet access (top rule under Outgoing access to the Internet):

The service group "CFU_Internet" contains http, https, and ICMP.

What I'm seeing is traffic from the LAN network (172.x.x.x) to the internet is getting dropped on the last rule in the policy (rule 5 under Incoming, Internal, and VPN traffic):

What am I missing? Why isn't this traffic allowed by the first manual rule I created?

Dave

Re: SMB Access Policy Control and internet access

Chris_Atkinson — Thu, 04 May 2023 23:50:26 GMT

Is your internet connection connected to a "WAN" port and what build of R77.20.87 firmware is used?

Re: SMB Access Policy Control and internet access

the_rock — Fri, 05 May 2023 00:21:50 GMT

Does 1st rule even have any hits? I noticed in the dropped log, shows inzone Internal and outzone as DMZ.

Re: SMB Access Policy Control and internet access

G_W_Albrecht — Fri, 05 May 2023 09:58:24 GMT

Using "Strict" is not really recommended out of my experience - i would suggest "Standard" with TP is secure enough 😉 You have to allow every detail in many seperate rules in strict mode, and that needs much knowledge...

Re: SMB Access Policy Control and internet access

David_C1 — Fri, 05 May 2023 13:03:14 GMT

Inspiration struck in the middle of the night. The reason this is not working is that I do not have an internet connection defined/configured. Traffic from the LAN networks bound for the internet goes out the DMZ interface which is connected to an MPLS network, which eventually comes back to our datacenter and out our internet egress point there. I had to get a bit creative with the routing (solution found in another CheckMates post) but everything is working now as I need it.

Thanks for everyone's suggestions,

Dave

Re: SMB Access Policy Control and internet access

the_rock — Fri, 05 May 2023 12:27:01 GMT

Excellent work @David_C1 👍