Skip to content
Avanet

Use Sophos Firewall IP Hosts, Services, and Groups Correctly

Sophos Firewall

IP hosts and services give addresses, networks, and ports meaningful names. A firewall rule can then show directly which source may communicate with which destination and service.

The important decision is the required scope: Create one address as IP, a subnet as Network, a contiguous address pool as IP range, and a small collection of individual addresses as IP list. For TCP and UDP, a service normally specifies the fixed Destination Port, while the dynamic Source Port remains unchanged.

Choose the appropriate host object

Four types are available under Hosts and services > IP host:

  • IP: Exactly one IPv4 or IPv6 address, such as a server, printer, or management system.
  • Network: A complete subnet with its network mask, such as 198.51.100.0/24.
  • IP range: A contiguous range, such as 203.0.113.10 to 203.0.113.20.
  • IP list: Several individual, noncontiguous addresses. A list supports up to 800 IP addresses and cannot be a member of an IP Host Group.

An FQDN host is more suitable when the destination address changes and a stable DNS name exists. Resolution, wildcards, and limitations are explained in Use FQDN hosts and wildcard FQDNs correctly.

As a general rule, use the smallest stable object that completely describes the required traffic. An object of type IP covers only one address and is too narrow for an entire subnet; a /24 network would be unnecessarily broad for a single server.

Create an IP host step by step

The following example represents one test server:

  1. Open Hosts and services > IP host and select Add.
  2. Enter host_test_web as the Name.
  3. Set IP version to IPv4.
  4. Select IP as the Type.
  5. Enter 192.0.2.10 under IP address.
  6. Select Save.

The following addresses from 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are reserved for documentation examples. In a production configuration, replace all names, addresses, and network sizes with values from the actual network.

Network, range, and IP list

The fields change with the selected type:

  • Network: net_test_branch with 198.51.100.0 and /24 represents the complete test network. Enter the network address, not the gateway address.
  • IP range: range_test_admins from 203.0.113.10 to 203.0.113.20 represents a contiguous pool.
  • IP list: list_test_hosts can contain 192.0.2.10,198.51.100.20, for example. A list is suitable for a few fixed individual addresses, not for continuously changing indicators of compromise.

For dynamically maintained malicious IP addresses, domains, or URLs, Threat feeds on Sophos Firewall are the more suitable feature. A manual IP list is not updated automatically.

IP Host Groups

Under Hosts and services > IP host group, hosts with the same functional purpose can be grouped together. For example, a group can contain all approved management systems and then be used in several rules.

Three important restrictions apply:

  • IPv4 and IPv6 hosts cannot be in the same IP Host Group.
  • A regular host can be a member of several groups.
  • An object of type IP list cannot be added to an IP Host Group.

Groups should have one shared meaning. A collection of servers, clients, and temporary exceptions may save clicks, but it later makes it difficult to understand why a rule allows access.

Understand system and interface hosts

SFOS creates several host objects automatically. These objects should not be recreated as regular custom hosts or edited in the wrong place:

  • Interface Hosts follow the IP configuration under Network > Interfaces and are changed there. Zones and interfaces on Sophos Firewall explains the relationship between a connection, zone, and rule.
  • ##WWAN1 is maintained dynamically for the cellular WAN interface.
  • ##ALL_SSLVPN_RW, ##ALL_SSLVPN_RW6, ##ALL_IPSEC_RW, and ##ALL_RW represent dynamic remote access hosts.
  • Other system hosts cannot be edited or deleted like custom objects.

The dynamic remote access hosts cannot be added to another IP Host Group. Physical Interface Hosts are not available in certain NAT fields, including Translated source and Translated destination. In that case, a separate IP host with the same address may be required. Its name should clearly show the relationship to the interface so it does not appear to be an unrelated address.

Create a service with the correct destination port

Before creating a service, check whether an appropriate default service such as HTTP, HTTPS, DNS, or NTP already exists. A custom service is useful when an application requires a different port or a special protocol combination.

The following example creates the TCP service for iPerf3:

  1. Open Hosts and services > Services and select Add.
  2. Enter svc_iperf3_tcp as the Name.
  3. Set Type to TCP/UDP and Protocol to TCP.
  4. Leave the default Source Port of 1:65535 unchanged.
  5. Enter 5201 as the Destination Port.
  6. Select Save.

The client normally selects its source port dynamically. If the service also restricted the source port to 5201, a normal connection would no longer match. The fixed server port therefore belongs under Destination Port. A restricted source port is only correct when the protocol explicitly requires it and real traffic confirms the behavior.

For an iPerf3 UDP test, also create svc_iperf3_udp with protocol UDP and destination port 5201. Because iPerf3 still uses a TCP control connection for a UDP test, combine both services:

  1. Open Hosts and services > Service group and select Add.
  2. Enter grp_iperf3 as the Name.
  3. Select svc_iperf3_tcp and svc_iperf3_udp.
  4. Select Save.

The complete measurement procedure is described in iPerf3 speed test through Sophos Firewall.

IP, ICMP, and ICMPv6

In addition to TCP and UDP, a custom service can specify an IP protocol number or ICMP/ICMPv6 types and codes. These types are intended for protocols that do not use a TCP or UDP port. Values should come from the application’s technical documentation rather than being guessed after a single failed test.

Use objects in a firewall rule

A host or service object does not allow traffic on its own. It only takes effect when used as a match criterion in a rule. A restrictive example could look like this:

  • Source zones: LAN
  • Source networks and devices: net_test_branch
  • Destination zones: DMZ
  • Destination networks: host_test_web
  • Services: HTTPS
  • Log firewall traffic: Enabled

Adjust the zones, addresses, and service to the actual network. Return traffic for an allowed stateful connection is permitted automatically. However, this rule does not permit independent new connections from the DMZ to the LAN. Understand and configure Sophos Firewall rules securely explains rule order, security features, and testing.

After saving, verify a real connection attempt in the Log Viewer. The expected Rule ID, source IP, destination IP, and destination port must appear. This distinguishes an incorrectly defined object from traffic being processed by a different rule.

Refresh Object Usage before changes

An object can be used in firewall and NAT rules, VPNs, SD-WAN routes, or other configurations. Before changing or deleting it, first check its dependencies.

The Usage column in the object list shows the known number of references. This counter is refreshed automatically only once a day. Before making a change:

  1. Select Refresh next to Usage.
  2. Open the updated counter for the affected object.
  3. Expand the categories and inspect every dependent rule or policy.
  4. Only then decide whether the object can be changed, replaced, or deleted.

Not every dependency can be edited directly from the Usage view. Some dependencies, including WAN gateways and CLI configurations, must be opened separately at the indicated configuration location. A counter of zero is a reliable basis only after a manual refresh.

Avoid common mistakes

  • Host instead of Network: An individual IP address does not automatically cover the associated subnet.
  • Incorrect network address or mask: For a Network object, the network address and prefix must match the actual segmentation.
  • Restricted Source Port: For regular client-server connections, keep 1:65535; restrict the Destination Port.
  • Too much Any: A precise host object loses its security value if the source or service remains unnecessarily broad.
  • Duplicated system object: SFOS maintains interface and remote access hosts, so they should not be copied without a specific reason.
  • IP list used as a threat feed: An IP list remains static and is not a replacement for automatically updated threat indicators.
  • Dependencies not refreshed: Always select Refresh in Object Usage before editing or deleting an object.

Descriptive prefixes such as host_, net_, range_, svc_, and grp_ are not a technical requirement, but they make searches and reviews easier. More important than the exact naming scheme is consistent use of names, purposes, and scopes throughout the rule set.

SFOS supports up to 16,000 hosts across all host types. For daily operations, a smaller and understandable object base is still more valuable than many nearly identical entries. Remove unused objects carefully after refreshing and reviewing their usage.