Sophos Firewall: Device Access and Local Service ACL

Under Administration > Device access, you define the zones from which local Sophos Firewall services are accessible. These include HTTPS for WebAdmin and the API, SSH, Ping, DNS, SNMP, SSL VPN, User Portal, and VPN Portal.

These services terminate directly on the firewall and form its management and service surface. If access is too broad, bots, compromised internal clients, or external attackers can reach sign-in pages, the API, and SSH directly to test credentials, known vulnerabilities, or misconfigurations. MFA and strong passwords remain important, but they do not limit reachability: Device Access reduces the attack surface before sign-in and is therefore one of the first hardening measures.

The identity source remains separate. If WebAdmin should use central TACACS+ credentials, TACACS+ for Sophos Firewall administrators covers server integration, local profile assignment, the pilot login, and fallback; HTTPS reachability continues to be restricted here.

The destination of the connection is what matters:

• Device Access zone table: Generally allows a local firewall service from a zone.
• Local service ACL exception rule: Allows or blocks a local service for specific sources, destinations, and services.
• Firewall rule: Controls traffic through the firewall, for example from LAN to a server in DMZ.

For example, when you open https://172.16.16.16:4444, the connection terminates on the firewall. A normal firewall rule therefore does not replace a Device Access permission.

⚠️ WebAdmin, SSH, and portals should only be accessible from networks that genuinely need them. For external administration, an admin VPN, Sophos Central Firewall Management in Sophos Fusion (sign in at fusion.sophos.com), a management network, or a narrow ACL exception is safer than broad WAN access.

Two special cases can bypass the zone table for HTTP and HTTPS services:

• Web Proxy: Requests made through the Web Proxy are treated as internal and cannot be controlled by source zone through Device Access. Anyone allowed to use the proxy can therefore reach WebAdmin, Captive Portal, VPN Portal, and User Portal even if the service is disabled for their own zone.
• Port Sharing: If VPN Portal and SSL VPN use the same port and the same protocol, VPN Portal becomes accessible from all SSL VPN access zones. The settings under Login security then no longer apply either.

These two paths must be tested separately during acceptance. The broader Sophos Firewall Hardening article places Device Access within the overall system-hardening strategy.

Plan zones and local services

The zone table is suitable for clear baseline permissions, such as DNS from LAN, Ping from a monitoring zone, or HTTPS from a management network. If only a single IP address or a small network needs access, an ACL Exception Rule is more precise.

A zone groups interfaces. For a custom zone, local service access can also be allowed or blocked under Network > Zones. Before making a change, therefore identify the actual ingress interface and its zone. Also prepare the narrow source object, the required interface host as the destination, and the service’s actual port. Existing IP hosts are listed under Hosts and services > IP host; interface hosts are maintained through Network > Interfaces.

Read the default matrix as a starting point

A new SFOS 22 configuration allows local services from the following zones by default. This matrix is not a hardening target: restores, migrations, the wizard, and later changes may differ, and services that are not required should be removed after positive and negative testing.

Typical decisions include:

• HTTPS: Allow WebAdmin and the API only from management networks or narrowly defined admin sources.
• SSH: Allow only for administration or support, preferably with a public key. For network SSH in SFOS 22/23, the documented login path uses the built-in admin account; CLI permissions granted by a profile do not confirm an SSH login path for a named administrator account. Only the default admin manages the public-key settings and keys.
• DNS: Allow only for internal client zones that use the firewall as a DNS resolver. DNS from WAN is not a normal client scenario.
• Ping/Ping6: Allow for required monitoring, not broadly from untrusted zones.
• SNMP: Allow only from the monitoring system or network; setup is described in SNMP hardware monitoring.
• RADIUS SSO: Only from the fixed accounting sender. RADIUS SSO with accounting explains the client-IP and user mapping.
• SSL VPN: Expose externally only as much as necessary, with MFA, logging, and a deliberately selected port and protocol.
• VPN Portal: Since SFOS 20, it provides Sophos Connect and IPsec and SSL VPN configurations.
• User Portal: Among other functions, it provides access to personal data, OTP tokens, quarantine, exceptions, and Policy Overrides, but not VPN configuration downloads.
• RED, SMTP Relay, and Dynamic Routing: Allow only in the intended networks or for defined peers. Configure PIM-SM on Sophos Firewall shows how to check this boundary for multicast neighbors; for small IPv4 routing domains, configure RIPv2 on Sophos Firewall explains the separate permissions for the peer zone and data traffic.

The service dialog additionally offers AD SSO, Captive portal, Chromebook SSO, Clients, IPsec, Web proxy, and Wireless Protection. A selectable service is not a recommendation for broad zone access; every selection needs a specific client, peer, or administration path. The search fields for Source Network / Host, Destination host, and Services also search attributes. For example, entering 53 finds the DNS service.

Since SFOS 22, WebAdmin, VPN Portal, and User Portal support TLS 1.3. Strong encryption, however, does not reduce the attack surface of an unnecessarily accessible service.

Device Access only determines from which network the WebAdmin console can be reached. If login should use Microsoft Entra ID, Entra ID SSO for Sophos Firewall WebAdmin explains the separate mapping of Entra roles and groups to local administrator profiles.

In addition, restrict-admin-console-wan-access can block WebAdmin access globally from all WAN sources. Check Advanced Firewall Settings safely explains the deliberately reversed enable/disable logic and the distinction from Local Service ACL.

Restrict sources narrowly

An ACL Exception Rule supports Country, Country group, FQDN host/group, Host group, IP address/list/range, MAC address/list, and Network as sources. Wildcard FQDNs are not supported.

Do not allow WebAdmin from WAN for all sources. SFOS does not allow the ACL exception to be created when Source Network / Host is set to Any or the source IP address is 0.0.0.0. This product restriction does not automatically make other large networks safe. A fixed admin IP, a small management network, or a maintained FQDN object is significantly safer. For mobile users whose source addresses change, administrative access should use a VPN or Sophos Fusion.

Since SFOS 19.5 MR2, broad WAN access for WebAdmin and User Portal is automatically disabled after 90 consecutive days without a successful sign-in. Specific WAN sources in ACL Exception Rules are unaffected and must still be reviewed regularly. The Sophos Firewall Health Check helps with recurring reviews of management access, MFA, and configuration.

Check Web Proxy and Port Sharing in advance

Before hardening, record the ports and protocols in use under Administration > Admin and user settings and in the SSL VPN global settings.

• WebAdmin uses TCP 4444 by default, User Portal TCP 4443, and VPN Portal TCP 443.
• SFOS 22/23 documents TCP 443 as the WAF default; record the actual configured WAF listeners before checking for conflicts.
• SSL VPN uses TCP 8443 by default; UDP can also be selected as the protocol.
• WebAdmin and User Portal must not share their port with other services.
• VPN Portal and SSL VPN should not use the same port and protocol because zone restrictions and Login Security would not work as expected.

If the Web Proxy is active, a test without the proxy is insufficient. The same portal or WebAdmin request must also be tested through the explicit proxy from a zone that should be blocked.

Set up Direct Web Proxy with a PAC file explains how to restrict the proxy listener to a pilot client and validate this exposure in a controlled manner.

Create a narrow Local Service ACL Exception Rule

Before direct WAN access to WebAdmin: In the Device Console, first use the read-only command show advanced-firewall to record the actual value of restrict-admin-console-wan-access and the installed build. For SFOS 22/23, Sophos describes enable as blocking WebAdmin from all WAN sources and as the default; this default does not replace the recorded previous value. The ACL instructions describe narrow WAN exceptions but do not establish their precedence over this global restriction. Do not assume that the following ACL exception alone makes WebAdmin reachable from WAN. With enable, retain the restriction and use the already tested, authorized admin VPN, management, or Fusion access path. If direct WAN access is unavoidable and the interaction for the installed build is not clearly established, stop the direct WAN change and clarify it with Sophos Support. If a positive test fails, check this prerequisite first rather than widening the ACL.

This ACL example is not an instruction to set the global switch to disable. Changing the global restriction requires a separately authorized change with a working independent administrative path, the documented actual previous value, its own tests from allowed and blocked WAN sources, and exact restoration of that previous value on abort and when temporary access ends. Do not make the change if the initial value or recovery path cannot be established reliably. Implement the following narrow WAN example only after these prerequisites have been resolved.

A typical exception allows WebAdmin from WAN only for a fixed support IP. The menu path is Administration > Device access > Local service ACL exception rule > Add.

1. Rule name: admin-https-from-support-ip
2. Rule position: For a specific WAN exception, select Top and check the other rules for overlaps.
3. Description: Document the purpose, ticket, and planned expiration date.
4. IP version: Select the version that matches the source, usually IPv4.
5. Source zone: WAN
6. Source Network / Host: Select a specific admin IP or a narrow, maintained object.
7. Destination host: Restrict it to the required firewall address or interface. Any expands the reachable destination addresses or interfaces, not the services selected under Services.
8. Services: Select only HTTPS; do not add SSH merely for convenience.
9. Action: Accept

Do not copy the example values unchanged. For an internal management network, the same pattern could use Source zone: LAN or a custom management zone, Source Network / Host: mgmt-net, the management IP’s interface host as Destination host, HTTPS, and Accept. To exclude a known source within a zone that otherwise requires access, use a separate, appropriately positioned rule with the narrow source object, only the affected services, and Drop. A country group is at most a coarse network boundary, not a substitute for a fixed admin source or a VPN.

Then save the rule and test from both an allowed and a disallowed source. Rule position matters: higher rules can affect the result. With overlapping rules, verify the actual behavior on the firewall rather than inferring it from the list alone.

API access

Three conditions must align for API access:

1. The API is enabled under Administration > API access.
2. The source address is included in Allowed IP hosts.
3. Device Access allows HTTPS from the relevant zone or through a suitable ACL exception.

Since SFOS 22, the API configuration is located under Administration and supports IP host objects for addresses, ranges, and networks. Up to 64 objects are possible. Broad HTTPS access is not required. The full configuration is described in Restrict Sophos Firewall API access securely.

XML automation: zone setting, not an ACL exception

The SFOS 22/23 XML zone documentation places HTTPS and SSH under Zone/ApplianceAccess/AdminServices/HTTPS and Zone/ApplianceAccess/AdminServices/SSH, respectively. This is local service access at zone level: neither a firewall rule for transit traffic nor a source-specific Local service ACL exception rule. Changing this branch affects management reachability from the zone; it does not restrict access to a single admin IP. For a narrow source permission, the ACL exception described above remains the appropriate boundary.

The documentation contradicts itself on values: the XML example shows Enable/Disable, while the combined parameter table repeats Enable and also lists 12 and 40. This does not establish a reliable boolean or numeric encoding. Resolve the syntax for the installed firmware before any automated write; this hierarchy explanation is not an executable access-permission template.

Nor is Zone/MemberPorts a write instruction: the XML example’s comment explicitly marks member ports as read-only. The optional CSV row in the table describes their display, not a verified way to change them. Before any automated zone change, test an independent, signed-in recovery path, then check allowed and blocked sources as described in the rollout below.

Remove a custom zone safely

Deleting a Local service ACL exception rule removes only that exception, not the named zone. Disabling a local service is not zone deletion either. Zones and interfaces explains the associations.

1. Under Network > Zones, identify the exact name of the custom zone no longer needed in production and document its previous state. Retired_Test is only an example, not a deletion target to copy. First sign in through and test the independent administrative path described in the rollout below; it must not depend on this zone or the interfaces or rules being changed.
2. Under Network > Interfaces, inspect every assignment to this zone, and under Rules and policies > Firewall rules, inspect every Source zone or Destination zone reference. Do not delete needed interfaces or rules: reassign them to the intended remaining zone only within an authorized change and verify the effect. If references must remain or their use is unclear, retain the zone and its dependencies and stop deletion. Do not cascade-delete productive dependencies to force removal.
3. Only after resolving dependencies, remove this named zone alone. The SFOS 22/23 XML documentation requires Name with at most 60 characters: first A-Za-z1-9 (not 0), then A-Za-z0-9_. This establishes neither wildcards nor automatic cascade deletion; no XML request or unsupported deletion dialog is specified here.
4. Afterwards, verify that only the intended zone is absent, the remaining interface assignments and firewall rules are correct, and required transit traffic still works. Retest local services from allowed and blocked sources and the independent administrative path. If behavior differs, stop and use that path to revert the documented changes selectively, not widen permissions.

The documented XML status values are 200 (ZoneDeleteSuccess), 500 (ZoneDeleteFailed), 503 (ZoneInterfaceExists), and 504 (ZoneFirewallRuleExists). For 503 or 504, recheck the relevant interface or rule references instead of indiscriminately deleting dependent objects. 500 is not success; even 200 does not replace follow-up verification.

DNS from the WAN

A DNS ACL exception from WAN alone does not cause the firewall to answer DNS queries there. A static DNS host with Publish on WAN would also have to be configured under Network > DNS. This should only be done for a specific authoritative use case; it must not turn the firewall into a public recursive resolver. Configure and test DNS host entries on Sophos Firewall explains delegation, the DNS host entry, and positive and negative tests.

Operational details before changing access

After an upgrade or restore from before SFOS 20, VPN Portal inherits the previous User Portal port, including a custom port. User Portal moves to 4443, or to 65040 if that port is occupied. Check the configured port rather than only its default before investigating an apparently missing ACL permission. VPN Portal users or groups must also belong to a suitable Remote Access policy; reachability alone does not grant user authorization.

The WAF listener must differ from VPN Portal in WAN IP address or port. Against SSL VPN, a different protocol is also sufficient: WAF and VPN Portal use TCP, while SSL VPN can use TCP or UDP. Listener separation is not the same as ACL permission; retest the affected services after every port change.

Dynamic Routing permits routing updates to the firewall, not data traffic through it. Enable it for the actual peer zone, not automatically for WAN. In the WAN example with two RIP firewalls, only the side with access enabled receives updates; the other drops them and does not learn the advertised networks. For one-sided missing routes, check the peer zone on both sides and then the protocol-specific configuration in the linked routing article.

The Messages widget in Control center can warn about WAN access to HTTPS and SSH. Review zone permissions and ACL exceptions and restrict access to a VPN or specific hosts and networks. Messages cannot be manually deleted; some disappear once their requirement is met. A disappearing message does not replace positive and negative tests. Master-key, registration, license, reports, and firmware messages belong in their respective operational workflows, not in an additional ACL rule.

Roll out changes without a lockout

Device Access changes take effect immediately.

The fallback path must still work after the planned zone or port change. A second browser tab using the same blocked access path is not independent. Before starting, record the exact previous settings and identify the person with console access; do not make a remote change without a working recovery path. For remote work, you must already be signed in through the second administrative path and have tested it before making the change.

1. Document the current zone permissions, ACL exceptions, ports, and required services.
2. Open an independent access path, such as the local console, management LAN, admin VPN, or Sophos Fusion.
3. For larger changes, have a current backup and the Secure Storage Master Key available.
4. Create the new narrow Accept exception without removing the existing broad permission yet.
5. Test allowed access as a baseline. While the broad zone permission remains active, this test does not yet prove that the new exception is taking effect.
6. Under Diagnostics > Packet capture, set a narrow filter for the source, destination, and port, and enable Trace On.
7. Remove the old broad zone permission through the independent administrative path.
8. Immediately perform a functional test of the service from the allowed source. A successful TCP/TLS or service connection and typically Status: Consumed confirm the positive case; Reason: LOCAL_ACL does not have to appear.
9. Test the same service from a disallowed source. For the blocked attempt, Status: Violation and Reason: LOCAL_ACL are typically expected.
10. For HTTP/HTTPS, also test the Web Proxy path; for portals, check the SSL VPN access zones.
11. Stop Packet Capture and check supplementary service or sign-in events in Log viewer. The rule ID shown in Packet Capture is the firewall rule ID, not the ID of the ACL Exception Rule, and can be 0 for local traffic.
12. Document the rule, purpose, owner, ticket, source, service, and review or expiration date.

Abort and rollback: If allowed access fails, use the independent administrative path to revert the last changed setting to its documented previous value and retest access. If a blocked source can still reach the service, do not widen permission: investigate the proxy, Port Sharing, and overlapping ACL rules and restrict the unwanted path without losing recovery access. Repeat both tests only after correction.

Compact documentation examples help with later reviews:

• HTTPS: Rule admin-https-from-mgmt, source mgmt-net, purpose WebAdmin, review quarterly.
• SSH: Source support-ip-temporary, purpose support case, delete after ticket closure.
• SNMP: Source monitoring-server, purpose hardware and interface monitoring, review every six months.
• SSL VPN: Source WAN, purpose Remote Access, review logs monthly.

For multiple firewalls or an HA cluster, change a system with good rollback options first. The guide Configure Sophos Firewall High Availability covers role changes and maintenance access.

Special cases and additional protection

User Portal, VPN Portal, and SSL VPN

First determine which portal is genuinely required. VPN clients and configurations belong in VPN Portal; User Portal provides other user functions. Sophos Firewall portals compared provides an overview.

If a Remote Access service must be accessible worldwide, MFA, restrictive user groups, and logging are more important than an unsuitable country restriction. Setup is described in MFA for WebAdmin, VPN Portal, and Remote Access. Port Sharing must still be avoided: authentication does not replace correct reachability controls.

Publicly accessible WebAdmin, User Portal, VPN Portal, and SSL VPN sign-in pages are quickly found by scanners and bots. Even with MFA, this creates brute-force traffic, log noise, and additional load.

If many failed VPN Portal logins or account lockouts are already occurring, Protect Sophos Firewall VPN Portal against brute force combines log review, identity checks, ACL containment, and follow-up verification into an incident workflow.

If a portal must remain accessible worldwide, Sophos Firewall Threat Feeds with the Block action can additionally block known malicious IPv4 sources from Third-Party Feeds such as Cybora, including traffic to the firewall itself. Domain or URL IoCs do not protect a sign-in endpoint from a malicious source IP, and IPv6 sources are not currently supported. Threat Feeds are therefore an additional safeguard, not a replacement for narrow ACLs. The linked article explains setup, testing, and allowlisting.

SSH and temporary support rules

SSH should only be accessible when needed from a management network, through a VPN, or for a fixed support IP. Public-key authentication is preferred. Delete the temporary ACL exception after a support case; do not assume a disable status that has not been confirmed in the current interface. Further steps are available in Connect to Sophos Firewall using SSH.

CLI permission is not the same as SSH login: According to the SFOS 22/23 profile description, the Administrator profile grants full CLI access without specifying the transport. By contrast, the PuTTY instructions for the same versions require the username admin for network SSH and exclude other usernames; this also applies to password login. These statements are not used here to infer SSH capability for named administrator accounts or to make a general claim about every form of CLI access. The WebAdmin Console function opens a browser console through the WebAdmin access path and is not evidence of a network SSH login. Whether a particular named account can use this browser access must be checked separately against its permissions and the installed firmware. Key management, which is restricted to the default admin, is also a separate permission and does not establish which accounts can log in to SSH with a password.

Verify the actual fallback path before changing an ACL: For the documented network SSH path, use the built-in admin account with its current credentials or a key configured for that account. Log in through the selected access path in a new session, open the required console, and record the account, transport, and firmware version in the change record; a reachable TCP port alone is insufficient. Working browser Console access still depends on the WebAdmin path and is not an independent fallback if that path is blocked. If a named account is required as an SSH fallback or the observed behavior contradicts the instructions, stop the change, retain an already tested, authorized access path, and clarify the exact account and transport scope with Sophos Support. Do not widen the ACL or use repeated login attempts as a substitute for this clarification.

Remove an expired exception under Administration > Device access > Local service ACL exception rule using Delete for that rule and confirm with OK. Test the administrative path still needed before deletion; afterwards confirm the former support source can no longer connect. An expiration date recorded here is a review requirement, not evidence of an automatic deletion mechanism.

Troubleshooting

For a suddenly unreachable login, also check Administration > Admin and user settings > Login security > Block login. This source-IP block depends on failed sign-ins and can affect WebAdmin, CLI, VPN Portal, and User Portal. It is not an ACL rule. Failed CAPTCHA attempts do not count as these sign-in attempts. Check the configured block duration and events instead of allowing HTTPS for an entire zone or indiscriminately disabling protection.

If a local service is not reachable or blocked as expected, check the following in order:

1. Destination and port: Is the firewall IP correct, and is the service using the expected port?
2. Source zone: Is the client connecting directly from the expected zone, through a VPN, or through the Web Proxy?
3. Zone table: Is the service allowed for this zone under Administration > Device access?
4. ACL exceptions: Do the IP version, source zone, source object, Destination host, Service, Action, and position match?
5. Port Sharing: Do VPN Portal and SSL VPN share the same port and protocol?
6. API: Do API enablement, Allowed IP hosts, and HTTPS Device Access all align?
7. DNS: Is DNS allowed for internal clients? WAN publishing additionally requires Publish on WAN.
8. Logs: Does Log Viewer show supplementary service or sign-in events?
9. Packet Capture: Start the trace before repeating the test. Allowed access must succeed functionally and typically shows Status: Consumed; the blocked attempt typically shows Status: Violation and Reason: LOCAL_ACL. The rule ID is not the ID of the ACL exception. Operation is explained in Sophos Firewall Packet Capture.

If WebAdmin or a portal remains accessible despite the source zone being disabled, test the Web Proxy and Port Sharing first. An additional firewall rule does not solve this problem.

For longer-term traceability, use Central Firewall Reporting or Send Sophos Firewall syslog to a SIEM.

Operational checklist

• WebAdmin is not broadly accessible from WAN, guest, IoT, or VoIP zones.
• HTTPS, SSH, and SNMP are restricted to specific management or monitoring sources.
• User Portal, VPN Portal, and SSL VPN are active only if required by the operating model.
• VPN Portal and SSL VPN do not share the same port and protocol.
• Web Proxy access to local HTTP/HTTPS services has been tested separately.
• API access, Allowed IP hosts, and HTTPS Device Access are aligned.
• Temporary ACL exceptions include a purpose and expiration date and are deleted after use.
• Allowed and blocked sources have been tested; logs confirm the result.
• Rules are reviewed regularly for outdated sources, unnecessary services, and broad Accept exceptions.

Source qualifications

STAS provides user authentication; it is not a VPN or encrypted administrative transport. Its authentication-service permission does not replace a protected management path.

The retained SFOS 22/23 SSH-key instructions are ambiguous: they specify RSA/DSA with at least 2048 bits and list ECDSA while excluding ED25519. Do not infer ED25519 support or treat DSA as a recommendation. Confirm the supported algorithm for the actual firmware before enrollment; upload only the public key and retain a separate recovery path. Device Access permission does not validate a key algorithm.

Adaptive Learning also includes detected-virus URLs, threat names/URLs/IP addresses, source IP addresses, and applications used. Default HTTPS reporting covers device, firmware, and license data (without owner information), feature/HA/cloud-management status, object counts, errors, and CPU/memory/disk percentages. Treat this as a data-disclosure decision, not an ACL control. Sophos Assistant is enabled by default; to turn it off, clear Turn on Sophos Assistant under Administration > Admin and user settings, click Apply, then sign out and back in. This does not disable telemetry.

FAQ