"bypass" traffic on startup

[fslomka]

Hello,

I have seen that when Untangle is booting(bridge mode), Untange doesn´t filter any traffic for about one minute.
Imagine Untangle is filtering E-Mail traffic and has been shut down for some time,
after booting it up again it will let all the spam trough it in this one minute period.

Is there a possibility to change that or a bug request?


fslomka

[WebFooL]

Hi fslomka,

This is a know issue.
The OS starts before the Untangle VM (UVM) that holds the filtering.
So depending on hardware there will be a period where traffic can pass without being filtered.

I think that I have seen a bug about it but i can not find it now.

So if you want to fill in a bug/enchantment report go to http://bugzilla.untangle.com

[fslomka]

Here it is... I hope that is alright.
http://bugzilla.untangle.com/show_bug.cgi?id=9863

[fslomka]

My bug request is a duplicate you were right WebFooL.
Reported: 2004-10-13 12:00 PDT by John Irwin bug id 48
As you can see this bug has bin filed in 2004, will there be a better solution then unplugging lan when untangle starts?

[sky-knight]

There isn't a solution to this, and to be honest I'm not sure there ever will be.

What do you want? Untangle to have a firewall rule in place on boot that halts all network traffic until the UVM cranks up and removes it?

It used to be that sessions cached before the UVM started would be except from UVM inspection until the session was rebuilt. This would allow users to fire up a browser to a site they normally couldn't access and auto-refresh their way to that site for the rest of the day.

Now as far as I know Untangle resets all sessions when the UVM starts, which subjects all traffic to inspection. So what damage do you expect to happen to your network in 30 seconds to 1 min? If Untangle is taking longer than that to boot you need better hardware.

[dwasserman]

I think fslomka are talking about a lot of spam can bypass in the uvm startup time when the internal smtp server are listening. Is not a bug, that is how any application works mounted on an operating system

[sky-knight]

Ahh yes I hadn't considered SPAM in this equation.

The best way to handle that, is in the case of a known reboot, simply disable the TCP 25 port forward before you reboot, and turn it back on manually after reboot. Not the best solution but at least it's workable. Your Untangle should never be rebooting itself while it's in production. If it is, things are going very wrong, or you're crazy and allowing automatic upgrade.