Sophos Firewall: Device Access and Local Service ACL

Under Administration > Device access, you define the zones from which local Sophos Firewall services are accessible. These include HTTPS for WebAdmin and the API, SSH, Ping, DNS, SNMP, SSL VPN, User Portal, and VPN Portal.

The destination of the connection is what matters:

• Device Access zone table: Generally allows a local firewall service from a zone.
• Local service ACL exception rule: Allows or blocks a local service for specific sources, destinations, and services.
• Firewall rule: Controls traffic through the firewall, for example from LAN to a server in DMZ.

For example, when you open https://172.16.16.16:4444, the connection terminates on the firewall. A normal firewall rule therefore does not replace a Device Access permission.

⚠️ WebAdmin, SSH, and portals should only be accessible from networks that genuinely need them. For external administration, an admin VPN, Sophos Central Firewall Management, a management network, or a narrow ACL exception is safer than broad WAN access.

Two special cases can bypass the zone table for HTTP and HTTPS services:

• Web Proxy: Requests made through the Web Proxy are treated as internal and cannot be controlled by source zone through Device Access. Anyone allowed to use the proxy can therefore reach WebAdmin, Captive Portal, VPN Portal, and User Portal even if the service is disabled for their own zone.
• Port Sharing: If VPN Portal and SSL VPN use the same port and the same protocol, VPN Portal becomes accessible from all SSL VPN access zones. The settings under Login security then no longer apply either.

These two paths must be tested separately during acceptance. The broader Sophos Firewall Hardening article places Device Access within the overall system-hardening strategy.

Plan zones and local services

The zone table is suitable for clear baseline permissions, such as DNS from LAN, Ping from a monitoring zone, or HTTPS from a management network. If only a single IP address or a small network needs access, an ACL Exception Rule is more precise.

Typical decisions include:

• HTTPS: Allow WebAdmin and the API only from management networks or narrowly defined admin sources.
• SSH: Allow only for administration or support, preferably with a public key. Administrators with the Administrator profile can receive CLI access; only the default admin manages the public-key settings and keys.
• DNS: Allow only for internal client zones that use the firewall as a DNS resolver. DNS from WAN is not a normal client scenario.
• Ping/Ping6: Allow for required monitoring, not broadly from untrusted zones.
• SNMP: Allow only from the monitoring system or network; setup is described in SNMP hardware monitoring.
• SSL VPN: Expose externally only as much as necessary, with MFA, logging, and a deliberately selected port and protocol.
• VPN Portal: Since SFOS 20, it provides Sophos Connect and IPsec and SSL VPN configurations.
• User Portal: Among other functions, it provides access to personal data, OTP tokens, quarantine, exceptions, and Policy Overrides, but not VPN configuration downloads.
• RED, SMTP Relay, and Dynamic Routing: Allow only in the intended networks or for defined peers.

Since SFOS 22, WebAdmin, VPN Portal, and User Portal support TLS 1.3. Strong encryption, however, does not reduce the attack surface of an unnecessarily accessible service.

Restrict sources narrowly

An ACL Exception Rule supports Country, Country group, FQDN host/group, Host group, IP address/list/range, MAC address/list, and Network as sources. Wildcard FQDNs are not supported.

Do not allow WebAdmin from WAN for all sources. A fixed admin IP, a small management network, or a maintained FQDN object is significantly safer. For mobile users whose source addresses change, administrative access should use a VPN or Sophos Central.

Since SFOS 19.5 MR2, broad WAN access for WebAdmin and User Portal is automatically disabled after 90 consecutive days without a successful sign-in. Specific WAN sources in ACL Exception Rules are unaffected and must still be reviewed regularly. The Sophos Firewall Health Check helps with recurring reviews of management access, MFA, and configuration.

Check Web Proxy and Port Sharing in advance

Before hardening, record the ports and protocols in use under Administration > Admin and user settings and in the SSL VPN global settings.

• WebAdmin uses TCP 4444 by default, User Portal TCP 4443, and VPN Portal TCP 443.
• SSL VPN uses TCP or UDP 8443 by default.
• WebAdmin and User Portal must not share their port with other services.
• VPN Portal and SSL VPN should not use the same port and protocol because zone restrictions and Login Security would not work as expected.

If the Web Proxy is active, a test without the proxy is insufficient. The same portal or WebAdmin request must also be tested through the explicit proxy from a zone that should be blocked.

Create a narrow Local Service ACL Exception Rule

A typical exception allows WebAdmin from WAN only for a fixed support IP. The menu path is Administration > Device access > Local service ACL exception rule > Add.

1. Rule name: admin-https-from-support-ip
2. Description: Document the purpose, ticket, and planned expiration date.
3. Rule position: For a specific WAN exception, select Top and check the other rules for overlaps.
4. IP version: Select the version that matches the source, usually IPv4.
5. Source zone: WAN
6. Source Network / Host: Select a specific admin IP or a narrow, maintained object.
7. Destination host: Restrict it to the required firewall address or interface. Any expands the reachable destination addresses or interfaces, not the services selected under Services.
8. Services: Select only HTTPS; do not add SSH merely for convenience.
9. Action: Accept

Then save the rule and test from both an allowed and a disallowed source. Rule position matters: higher rules can affect the result. With overlapping rules, verify the actual behavior on the firewall rather than inferring it from the list alone.

API access

Three conditions must align for API access:

1. The API is enabled under Administration > API access.
2. The source address is included in Allowed IP hosts.
3. Device Access allows HTTPS from the relevant zone or through a suitable ACL exception.

Since SFOS 22, the API configuration is located under Administration and supports IP host objects for addresses, ranges, and networks. Up to 64 objects are possible. Broad HTTPS access is not required. The full configuration is described in Restrict Sophos Firewall API access securely.

DNS from the WAN

A DNS ACL exception from WAN alone does not cause the firewall to answer DNS queries there. A static DNS host with Publish on WAN would also have to be configured under Network > DNS. This should only be done for a specific authoritative use case; it must not turn the firewall into a public recursive resolver.

Roll out changes without a lockout

Device Access changes take effect immediately. For remote work, you must already be signed in through the second administrative path and have tested it before making the change.

1. Document the current zone permissions, ACL exceptions, ports, and required services.
2. Open an independent access path, such as the local console, management LAN, admin VPN, or Sophos Central.
3. For larger changes, have a current backup and the Secure Storage Master Key available.
4. Create the new narrow Accept exception without removing the existing broad permission yet.
5. Test allowed access as a baseline. While the broad zone permission remains active, this test does not yet prove that the new exception is taking effect.
6. Under Diagnostics > Packet capture, set a narrow filter for the source, destination, and port, and enable Trace On.
7. Remove the old broad zone permission through the independent administrative path.
8. Immediately perform a functional test of the service from the allowed source. A successful TCP/TLS or service connection and typically Status: Consumed confirm the positive case; Reason: LOCAL_ACL does not have to appear.
9. Test the same service from a disallowed source. For the blocked attempt, Status: Violation and Reason: LOCAL_ACL are typically expected.
10. For HTTP/HTTPS, also test the Web Proxy path; for portals, check the SSL VPN access zones.
11. Stop Packet Capture and check supplementary service or sign-in events in Log viewer. The rule ID shown in Packet Capture is the firewall rule ID, not the ID of the ACL Exception Rule, and can be 0 for local traffic.
12. Document the rule, purpose, owner, ticket, source, service, and review or expiration date.

Abort and rollback: If the allowed source does not work after the broad permission has been removed, or a blocked source can still reach the service, immediately restore the broad permission through the independent administrative path. Then correct the new or conflicting ACL rule and repeat the process.

Compact documentation examples help with later reviews:

• HTTPS: Rule admin-https-from-mgmt, source mgmt-net, purpose WebAdmin, review quarterly.
• SSH: Source support-ip-temporary, purpose support case, delete after ticket closure.
• SNMP: Source monitoring-server, purpose hardware and interface monitoring, review every six months.
• SSL VPN: Source WAN, purpose Remote Access, review logs monthly.

For multiple firewalls or an HA cluster, change a system with good rollback options first. The guide Configure Sophos Firewall High Availability covers role changes and maintenance access.

Special cases and additional protection

User Portal, VPN Portal, and SSL VPN

First determine which portal is genuinely required. VPN clients and configurations belong in VPN Portal; User Portal provides other user functions. Sophos Firewall portals compared provides an overview.

If a Remote Access service must be accessible worldwide, MFA, restrictive user groups, and logging are more important than an unsuitable country restriction. Setup is described in MFA for WebAdmin, VPN Portal, and Remote Access. Port Sharing must still be avoided: authentication does not replace correct reachability controls.

Publicly accessible WebAdmin, User Portal, VPN Portal, and SSL VPN sign-in pages are quickly found by scanners and bots. Even with MFA, this creates brute-force traffic, log noise, and additional load.

Third-Party Threat Feeds can block system-destined traffic when the feed action is Block and the source address is present as a matching IPv4 IoC. Domain or URL IoCs do not protect a sign-in endpoint from a malicious source IP, and IPv6 sources are not currently covered either. Threat Feeds are therefore an additional safeguard, not a replacement for narrow ACLs. Sophos Firewall Threat Feeds explains planning and allowlisting.

SSH and temporary support rules

SSH should only be accessible when needed from a management network, through a VPN, or for a fixed support IP. Public-key authentication is preferred. Delete the temporary ACL exception after a support case; do not assume a disable status that has not been confirmed in the current interface. Further steps are available in Connect to Sophos Firewall using SSH.

Troubleshooting

If a local service is not reachable or blocked as expected, check the following in order:

1. Destination and port: Is the firewall IP correct, and is the service using the expected port?
2. Source zone: Is the client connecting directly from the expected zone, through a VPN, or through the Web Proxy?
3. Zone table: Is the service allowed for this zone under Administration > Device access?
4. ACL exceptions: Do the IP version, source zone, source object, Destination host, Service, Action, and position match?
5. Port Sharing: Do VPN Portal and SSL VPN share the same port and protocol?
6. API: Do API enablement, Allowed IP hosts, and HTTPS Device Access all align?
7. DNS: Is DNS allowed for internal clients? WAN publishing additionally requires Publish on WAN.
8. Logs: Does Log Viewer show supplementary service or sign-in events?
9. Packet Capture: Start the trace before repeating the test. Allowed access must succeed functionally and typically shows Status: Consumed; the blocked attempt typically shows Status: Violation and Reason: LOCAL_ACL. The rule ID is not the ID of the ACL exception. Operation is explained in Sophos Firewall Packet Capture.

If WebAdmin or a portal remains accessible despite the source zone being disabled, test the Web Proxy and Port Sharing first. An additional firewall rule does not solve this problem.

For longer-term traceability, use Central Firewall Reporting or Send Sophos Firewall syslog to a SIEM.

Operational checklist

• WebAdmin is not broadly accessible from WAN, guest, IoT, or VoIP zones.
• HTTPS, SSH, and SNMP are restricted to specific management or monitoring sources.
• User Portal, VPN Portal, and SSL VPN are active only if required by the operating model.
• VPN Portal and SSL VPN do not share the same port and protocol.
• Web Proxy access to local HTTP/HTTPS services has been tested separately.
• API access, Allowed IP hosts, and HTTPS Device Access are aligned.
• Temporary ACL exceptions include a purpose and expiration date and are deleted after use.
• Allowed and blocked sources have been tested; logs confirm the result.
• Rules are reviewed regularly for outdated sources, unnecessary services, and broad Accept exceptions.

FAQ