3 ms·

Fun fact: People behind a WatchGuard firewall (default settings) won't see Google fonts (at least in Firefox) because the firewall filters the CORS headers.

• ademarre 10y ago
  What an awful overreach. Firewalls should not ship with defaults that break the internet, and such presumptuous header filtering can actually weaken security.
  • stesch 10y ago
    Filtering X-Frame-Options is bad for security. Filtering anti CSRF headers like in Drupal and ShopWare is bad for security. But this seems to be the current reality with enterprise firewalls. :-( (No, TLS doesn't help in the long run. If your boss wants to know which pages you are reading he will let the experts setup this: https://www.howtoforge.com/filtering-https-traffic-with-squid https://www.howtoforge.com/filtering-https-traffic-with-squi...)
    • ademarre 10y ago
      Or this WatchGuard HTTPS proxy config: http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content/en-us/certificates/cert_https_proxy_resign_c.html http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...
      • stesch 10y ago
        Nice. I'm just the victim. Whenever I suspect the firewall to be the cause of a problem I use a proxy via a ssh tunnel. As long as it's not forbidden for me to actually solve problems. The list of software that isn't usable behind a WatchGuard firewall (and maybe similar enterprise firewalls) is getting longer and longer. No Google fonts, no Drupal, no ShopWare 5.2, JIRA barely usable, etc.
        • jlgaddis 10y ago
          I'm sure I can find plenty of examples just by searching (and I'll do that in just a moment) but do you happen to have a list of these issues that you've encountered that can be attributed to WatchGuard firewalls? I am (primarily) a network engineer and such a list would be wonderful to have when recommending for or against specific products.
  • jlgaddis 10y ago
    Cisco ASA firewalls perform "application inspection" (enabled by default) that breaks EDNS0, (SMTP) STARTTLS, and others.