Is it reasonably safe to uncheck autoblock source of packets not handled?

Posted on 2008-10-02
Medium Priority
Last Modified: 2013-11-16
Trying to troubleshoot some performance issues with a certain website that we subscribe to, I installed pingplotter at the suggestion of the vendor. Pinging/trace routing the site caused it to be blocked by our Firebox, due to the "autoblock source of packets not handled" option. Watchguard suggested that we uncheck  autoblock source of packets not handled and that it would be ok to do so.

What are the thoughts out there about this? I'm guessing it is probably OK to do so while I'm testing, but what about leaving it that way? Am I inadvertently blocking other legitimate sites? (I know, I should check the logs to answer that question).

There isn't really a solution to the Q - but I'd like to have some info to make an informed decision.

thanks for any input.
Question by:youngslim
LVL 32

Accepted Solution

dpk_wal earned 800 total points
ID: 22626053
No problems in leaving that option disabled always; in the latest version of software and even in 9.x the option is disabled by default.

Let's first understand what this option implies; let's say you are not hosting any servers and by default all incoming traffic coming on the external interface of the firebox from the internet would be denied; if the option is enabled; in addition to denying the packets (default behavior no configuration needed for this) the firewall in addition block the source of packets and put them under blocked sites [System Manager->Blocked site tab]. If the option is disabled the firewall continues to deny the packet; just does not put the source of IP under blocked site.

What you loose; if you are a target of some port scan and the IP is under blocked list, then the firewall would not attempt to see if the rules permit/deny the requested port/protocol; thus saving CPU cycle.

Hope this help; please let know if you need more details.

Thank you.

Author Closing Comment

ID: 31502443
That was a good, informative answer. Thanks,


Featured Post

WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question