EFW block port 80 on one ip address

[Guest]

[rosol]

Hello.

I'm finishing testing Endian on VMware.
It's commercial version - my support is disabled currently :-(
Endian is in 3.0.5 version and last update is 08-10-2015

I'm getting issue like in subject.

Firewall has rule to allow with IPS traffic on port 80 to RED.
And all traffic on 80 port works fine, web pages display correctly expect one ip address.
This blocked ip address on 80 port isn't blocked on 443 port.

IDS is enabled but with default rules, i mean it's not blocking but it's in listening and reporting state.

When i've turned off outgoing connections of FW, got the same issue, this specified ip address is still blocked on 80 port.

Do you have ane advice how to fix it or check what's blocking this ip address on 80 port only?

Thank you.

[rosol]

I've forgot.
On IDS logs got only this one:

Date:   Aug 19 13:24:34   Name:   (portscan) TCP Portsweep
Priority:   n/a   Type:   n/a
IP info:   192.168.1.124:n/a -> 195.78.66.217:n/a
References:   none found   SID:   n/a

This 195.78.66.217 ip address is blocked on 80 port only.
Other ones are pass through.

[Gabriel GHEORGHIU]

Hi rosol,

Did you open port 80 on 195.78.66.217?

Best regards,
Gabriel

[rosol]

Hello.

FW policy says that all outgoing traffic on 80 port is allowed with IPS.
Additionally i've created rule to open 80 port on this 195.78.66.217 blocked ip address as first rule.
Still got the same issue.

[Gabriel GHEORGHIU]

Hello,

Can you draw a schematic of your configuration  (how are you using EFW 3.0.5)?

[rosol]

Hello.

Below is schema:

Internal network-->FW-->Internet

Very easy :-)

FW is as virtual machine.

[Gabriel GHEORGHIU]

Hello,

Ok.
I saw that on 195.78.66.217 are open only the ports 21, 80, 443.

Maybe on that server are allowed, by the firewall in front of it, connections only on port 443 (https) and all conections that are coming on port 80 (hhtp) are dropped or redirected to 443.

(When I have used MS ForfrontTMG, for Webmail access, I have allowed only connections to https, using redirection of port 80 to 443).

[rosol]

Hello.

No, you're wrong.
This ip address on port 80 has worked fine and from others ip addresses i'm able to open this web page.
Now i'm in contact to support of this host due to perhaps block my traffic on port 80.

Thank you for help.

[Gabriel GHEORGHIU]

You are welcome!