Hello,

I am looking to use GFI webmonitor in Simple Proxy mode with A Windows SBS 2003 server (Single NIC). Has anyone been able to configure the filter rules to block all outbound traffic on port 80 and forward it onto the SBS server for GFI to check. Before sending request back out through the Router?

The GFI 'getting started' guide has some info on it. but it appears to have steps missing. :?

thanks in advance...

Sorry, I don't have any suggestions but I would be interested to know if you got anywhere with it.

what you are trying to do is policy based routing or proxy forwarding.

I wanted to do the same thing, but my draytek 28280 does not support this.

I had to use my Billion S10 SSLVPN appliance to do this.

yeh I had feared this was a limitation on my 2820n.
Do you know if there is a way for the Draytek to block all outbound traffic (on all ports)unless it comes from a specific IP address or group of IP addresses. and can we then tell the router which ports to open outbound to allow traffic from those IP addresses?

Basically, I would now like to restrict all outbound traffic from all PC's on the LAN except from certain PC's and only then only have certain ports open.

Is this achievable?

regards

You can do this.

Do you have any VPNs to or from your 2820? If not then this will work.

1. Create IP objects for the machines that you want to allow out
2. Create an IP Group and add these IP objects.
3. Create Service Type Objects for any traffic that that you want permitted.
4. Create Service type Group containing the Service type objects.
5. Find an empty filer (under firewall)
6. add entries to allow dns from LAN to WAN from your workstations or your server (if is is runing DNS). Add any other traffic that you want allowed.
7. Change the default action rule on the firewall general tab to Block, but remember to set the Data filter to the newly created filter.

It should now work. If not setup syslog (and the server) and enable the syslog option for the default block policy.

To undo, change the Data filter back to the original setting, and change the default policy to allow.

Have fun


Here are some service types you may need:

DNS UDP 53
HTTPS TCP 443,8443
HTTP TCP 80-82,8080
EMAIL TCP 25,110,993,995
NTP UDP 123
FTP TCP/UDP 20-21
ICMP
RTSP 554
RTMP 1935
NETBIOS TCP/UDP 135 & 139