Please add back the Drop Silently feature
Port 80 and Port 443 can’t be silently dropped by the firewall & logs incorrectly report traffic as “Accepted.” Even traffic that is "Dropped" gets a response form the firewall.
Firstly this is nonsensical. After weeks of back and forth Sophos support told us this is the intended behavior. Sadly this behavior makes the log files misrepresent the action taken, all traffic that get a "Drop" action shows as "Accept" in the logs.
Secondly it removes the first layer of protection. Normally we use "Drop" to silently hide from unwanted traffic and potential attackers, this "new feature" Sophos added eliminates that first line of defense.
Jim
shared this idea
1 comment
-
Jim
commented
PS if there is a great benefit to the Sophos approach of forwarding everything to a proxy (whats causing all this according to Sophos Support) please let me know.
