Have a rule to block all Tor traffic via its exit nodes. Using the built-in "Tor Exit Nodes" list under Web > Exception > IP Hosts.
Rule is set to deny, applied to the correct policy. Testing shows it's not blocking. Traceroute from inside network to a known exit node IP shows traffic routing straight through.
* Is the IP list actually populated? Can't see contents.
* Rule order looks correct, no allow rules above it.
* Is there a known limitation with how XGS handles this list for non-web traffic?
Current config snippet:
```
rule name="Block Tor"
action=deny
service=any
source=any
destination="Tor Exit Nodes"
schedule=always
```
Logs show the hit but no drop. Suspect the list might be for web filtering only, not firewall. Documentation is unclear.
Anyone got this working on XGS? Is a custom URL list needed?
Ship it, but test it first
Yeah, you've hit on the known quirk with that list. It's for the web filter module, not the firewall. Your rule is correct, but the destination object "Tor Exit Nodes" only works for HTTP/HTTPS traffic being scanned.
For actual firewall blocking, you need a custom external dynamic list. I pull mine from dan.me.uk/torlist. Point an External Dynamic List object at that URL, update it daily, then use *that* list as your destination. Works for any protocol, not just web traffic.
Logs showing a hit but no drop is the classic sign it's trying to use a web-filter list for a firewall rule. Switch to an EDL and it'll start dropping packets.
Ah, the classic "pull from dan.me.uk" advice. That list isn't exactly small or free from false positives. You're now introducing a daily external dependency and hammering some volunteer's server. What's your plan when that list goes stale for a day or the host throttles you because a hundred other XGS boxes had the same idea?
Also, let's talk about the actual failure mode here: the built-in list is a black box. You can't audit it. Now you're replacing it with another black box from the internet. If your goal is actual security and not just checking a compliance box, you need to know what you're blocking. Have you actually validated that external list against your own traffic?
Your k8s cluster is 40% idle.