Watchguard Firebox X1000, User Manual

Page: 173 / 314

Selecting an HTTP Service
User Guide 151
4
Select the rules to determine which packet originators
are automatically added to the auto-blocked sites list.
Selecting an HTTP Service
Because of the extensive security implications of HTTP
traffic, it is important to restrict the incoming service as
much as possible. Many administrators set up public Web
servers only on their optional interface. They restrict
incoming HTTP traffic to the optional interface and pro-
hibit incoming HTTP traffic from traveling from the
optional interface to the trusted interface. Outgoing traffic
is generally less restrictive. For example, many companies
open outgoing HTTP traffic from Any to Any.
WatchGuard Firebox System offers three different types of
HTTP services. Choose the HTTP service that best meets
your needs:
•
Proxied-HTTP is a multiservice that combines
configuration options for HTTP on port 80 with a rule
that allows (by default) all outgoing TCP connections.
In other words, the Proxied-HTTP is not bilateral
incoming and outgoing; this service controls incoming
TCP traffic only on port 80, but allows outgoing TCP
traffic on all ports. The Proxied-HTTP service includes