Items Show up inBlocked Conversations Heatmap that have been added to exclusions

[Meg]

Hello: I have hosts (i4.c.eset.com, and c.eset.com) required for live grid on eset antivirus that have been added to exclusions but are still showing in blocked conversations heat map. Can anyone explain to me why these items are being blocked when they have been excluded globally.

[sy]

Hi,

What is the Block Message in Blocks report for these domains?

[Meg]

Thanks for the reply SY: Im not sure what you mean Block Message in Blocks report. Where do I find that?

[sy]

Hi,

In the Live Sessions - Blocks tab, there is a "Block Message" column. If it does not exist, you can enable it from the Layout section on the same page.

[Meg]

The block message is firstly seen sites. I don't understand why it still gets blocked when it is added to the exclusions list.

[Seimus]

Did you exlude them as i4.c.eset.com, and c.eset.com or as eset.com?
Can you make a pic and show us the exact exclusion in ZA?

Regards,
S.

[Meg]

Thanks Seimus. Yes I had excluded them as you said , but they keep getting blocked

[Seimus]

This is wierd,

On the heatmap actually they are shown as
i4.c.eset.com:80
c.eset.com:80

From perspective of the domain, this is different from i4.c.eset.com & c.eset.com. I think ZA here is for some reason showing the domain with the port 80. Cloud be a BUG

Regards,
S.

[Meg]

Thanks for your reply. I will wait and see if anybody else has any more insight into this. I don't remember it doing this on earlier versions of opnsense.

[Meg]

Update: I put in the ip address that the host name resolves to instead of the host name in the exclusions and it seems to have solved the problem so far.

[sy]

Hi,

Most probably "*:80" causes the issue. If you can share debug logs we can investigate it. You can increase log level in Settings - Logging - Level - DEBUG4. then please contact to the support team via "Have Feedback" option in the bottom left corner of UI to share the logs.

[sy]

Hi @Meg,

We have determined the issue. It is due to the hostname is with ":80" port number and doesn't match to the whitelisted domain. The next maintenance release will have a fix for this.

[Meg]

I have sent report as requested.

[sy]

Hi,

Thanks for sharing. It will be fixed with the upcoming release.