blocking client traffic to the wingate machine/internet

[phil_uk]

I wish to heavily restrict the client traffic to the wingate machine and to the internet. I am trialling wingate having moved from a competitior product, and with that product it was easy.

In the ENS I have set the deafult action for udp/tcp traffic for both lan to wingate, and lan to internet as deny. then allowed only specific traffic such as HTTP (port 80). However things seems to still get through, such as FTP and secure HTTP, am I doing something wrong, and can I actually do this ?

[MattP]

Hi Phil,

If you have the FTP service bound to an internal adapter then it will create a hole in the firewall for itself, this will therefore continue to allow traffic on port 21 even though you've changed the default action to deny. So you can remove the bindings from the FTP proxy to stop this from happening.

If you are making a connection to the WWW proxy server in WinGate then this may be allowing the secure and FTP connections as this proxy will handle both types of requests.

You should be able to see what kind of connections are being made by looking in the activity or history screens. If it turns out that the WWW proxy is making the connections then you can create policies in the WWW proxy to further restrict this.

For example, to block FTP requests through the WWW proxy service:
Open the WWW proxy service
Choose policies
Change default rights to "are ignored"
Click Add
Select Everyone (or the relevant user/group)
Choose the advanced tab
Select "specify which requests this recipient has rights for"
Click Add filter
Click Add criterion
Select "this criterion is NOT met if"
Session description
Contains
ftp
Ok your way out and attempt an FTP connection from your web browser, it should be denied.