why does this block message mean to me?

[carboncow]

Trying to download software form downloads.cnet.com and was getting this 404 error with spyware in the URL from our firewall. I was able to get the software by turning off the spyware app...but adding the domain downloads.cnet.com nor the local IP of the client PC trying to download didn't allow.

Why a 404 error and not must a message about content being blocked?

[drsminkus]

You should be getting a page blocked error page there. Are you getting other blocked error pages from other modules like the web filter module?

Try to browse to http://10.0.0.1/spyware/detect.jsp . That should give you an error but one that looks nothing at all like that error.

[dmorris]

did you do anything with port forwards?

thats not an apache 404 page. My guess is that you port forwarded port 80 traffic somewhere else and you set 'port forwards override administration'

[sky-knight]

That is an IIS 7 404. You've pushed your traffic to a 2k8 box?

[carboncow]

I do have a forward for port 80 on the Untangle Firewall to one of our servers and have had that setup since the first day of testing w/o concern. Nothing has been changed and it works as it should for outside requests. How would this effect requests inside the LAN trying to get out to cnet.com?

As far as drsminkus' comments I'm not really sure what to make of that. When I go to the link you supplied I see the same page as in my screenshot.

[carboncow]

OK, I do see what you mean that the 404 page is not from the Untangle server even knowing the IP address listed is in fact it. So something is re-routing to our webserver...interesting.

[carboncow]

No other modules are being blocked for any users at this time, just me trying to get to this one page. as dmorris says this is pointing to an internal webserver...doesn't make much sense. May reboot Untangle server.

[drsminkus]

Make sure that your port forward rule has a source interface listed (most likely WAN). This should allow you to keep the port forward and still have port 80 go to local on the internal side.

[carboncow]

That is an IIS 7 404. You've pushed your traffic to a 2k8 box?

I see that now..anyone got an idea how this is routing to our SBS server for this single request? Can something be goofy on the Untangle side?

[carboncow]

Make sure that your port forward rule has a source interface listed (most likely WAN). This should allow you to keep the port forward and still have port 80 go to local on the internal side.

Attached is my forward rule, can you explain to me what is wrong with it?

After several weeks of testing why would this one page be trying to point to my internal server from a client computer on the same WAN?