[7.460][QUESTION][OPEN] Connection refused on shared resources

[wingman]

Hi All

The issue I am facing is that I am unable to access resources on my media client
It used to work on version 7.404 but after updating to v7.460 is doesn't work.
I am getting the following error via the HTTP log

2009:06:27-16:05:45 Enterprise httpproxy[4075]: [0xa9c538f0] send_request_headers (request.c:171) write: Connection refused 
2009:06:27-16:05:45 Enterprise httpproxy[4075]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="OPTIONS" srcip="192.168.2.31" user="" statuscode="502" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2135" time="2 ms" request="0xa9c538f0" url="http://172.16.1.2/" exceptions="" error="" category="9998" reputation="neutral" categoryname="Uncategorized"

I am not blocking uncategorized and neutral. PF rules are ok since I can see the traffic logged for the client 172.16.1.2

Any ideas?

[BAlfson]

It looks like the HTTP Proxy is blocking traffic with your DMZ. Are you sure you haven't selected the 'Suspicious and uncategorized' checkbox in the middle of the list of categories?

[wingman]

The DMZ zone only blocks the following:

DMZ Zone filter
-------------------
Anonymizers
Anonymizing Utilities
Parked Domain
Phishing
Spam URLs
Spyware/Adware

It was the exact same config I was using on v7.404. Do you know what is the following:

2009:06:27-16:05:45 Enterprise httpproxy[4075]: [0xa9c538f0] send_request_headers (request.c:171) write: Connection refused

[BAlfson]

The issue is with the filtering done on the Internal network, not on that done on the DMZ network. What does that cinfig look like?

I dunno, I had assumed that line was part of the blocking.

Cheers - Bob

[wingman]

I was about to edit my previous post cause I accidentally told you about the DMZ. Internal zone blocks the following only:

Zone 1 filter
------------------------
Anonymizers
Anonymizing Utilities
Parked Domain
Phishing
Spam URLs
Spyware/Adware

[Billybob]

Routing is probably getting confused since more than likely dmz is allowed to surf via http proxy also. But the error in the logs would indicate that the proxy is blocking it which doesn't make sense. Do you have packet filter rule allow LAN-->http to dmz by any chance?
If you do, as a work around, try putting 172.16.1.2 in transparent skiplist under http/s-->advanced-->Transparent mode skiplist. Also uncheck the box Allow HTTP traffic for listed hosts/nets after you add the IP. I am assuming you are using transparent proxy and see if it works.
It still might be a bug though in http proxy. HTTP proxy was fine in 7.450 but is not the stablest thing in 7.460 in my opinion.

[wingman]

Originally Posted by Billybob

Routing is probably getting confused since more than likely dmz is allowed to surf via http proxy also. But the error in the logs would indicate that the proxy is blocking it which doesn't make sense. Do you have packet filter rule allow LAN-->http to dmz by any chance?
If you do, as a work around, try putting 172.16.1.2 in transparent skiplist under http/s-->advanced-->Transparent mode skiplist. Also uncheck the box Allow HTTP traffic for listed hosts/nets after you add the IP. I am assuming you are using transparent proxy and see if it works.
It still might be a bug though in http proxy. HTTP proxy was fine in 7.450 but is not the stablest thing in 7.460 in my opinion.

i have a rule that only allows specific (netbios,ping etc) trafic to DMZ and is on the top of the rules. When I enable the logging for this rule I can see the traffic allowed but still traffic is blocked by the proxy.

[wingman]

it seems that https proxy is not stable. I have the same issue with a website and I explicity allowed it on the http proxy

seems strange

2009:06:27-20:42:19 Enterprise httpproxy[8978]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.2.31" user="" statuscode="400" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction=" ()" size="2371" time="0 ms" request="0xa83d4490" url="http://update.filezilla-project.org/updatecheck.php?platform=i586-pc-mingw32msvc&version=3.2.5&osversion=5.1&beta=1" exceptions="" error=""

[wingman]

strangely enough ,one of the vista clients can connect with no issues to the shared resources and there is no log when they try to connect on the HTTP log. the two clients are in the same proxy filter and have the exact same proxy settings.However, I am getting the below error:

2009:06:27-23:00:20 Enterprise httpproxy[4028]: [0xa8c75808] send_request_headers (request.c:171) write: Connection refused
2009:06:27-23:00:20 Enterprise httpproxy[4028]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="OPTIONS" srcip="192.168.2.31" user="" statuscode="502" cached="0" profile="REF_TJkZFLrkmc (Zone 1 Proxy filter)" filteraction="REF_KvAnposSQm (Zone 1 Filter)" size="2135" time="2 ms" request="0xa8c75808" url="http://172.16.1.2/" exceptions="" error="" category="9998" reputation="neutral" categoryname="Uncategorized

and the vista client isn't

[Astaro Beta Bot]

Astaro Beta Report
--------------------------------
Version: 7.460
Type: QUESTION
State: OPEN
Reporter: wingman
Contributor: 
MantisID: 
--------------------------------