Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a lot of legitimate outbound traffic intermittently being denied by WatchGuard's "Internal Policy." Today I tried to go to Splunk's homepage and my traffic was denied by my watchguard XTM 22 with Pro upgrade.

What is the "Internal Policy" and what can I do to control it?

Example of Traffic being blocked

Type    Date            Action      Source IP   Port    Interface       Destination IP  Port    Policy  
Traffic 2011-09-21T18:24:43 Deny   49627   3-Primary LAN   80  Firebox Internal Policy http/tcp

Top three firewall policies:

enter image description here

share|improve this question
up vote 2 down vote accepted

The first firewall policy is "Deny any traffic from", so that's what it's doing (your source IP is in the deny message).

Policies are applied from top to bottom, and denies before allows, so that policy matches, denies the traffic, and no more are looked at.

What can you do about it? Change the policies.

share|improve this answer
It is not a deny policy, the bar sinister indicates that the policy is disabled. That Policy is only there why I need to test out the secondary WAN connection using Policy Based Routing. – vfilby Oct 3 '11 at 13:35
Also, the blocked packets are intermittent which isn't what I would expect from a block policy. And the policy in the log message would say 'FromVince' as opposed to 'Firebox Internal Policy'. – vfilby Oct 3 '11 at 13:37
Oops. OK. The "internal policy" I can think of now is the blocked sites list, or the blocked ports list (which takes precedense over an Any-allowed rule. Previous versions of the firmware were happy to put internal IP addresses in the blocked sites list, which might explain why it's intermittent - although the latest version doesn't do that. – TessellatingHeckler Oct 3 '11 at 19:49
That may be the case, I have never seen anything in the blocked sites list but the time duration is set to 1min. I will have to look into this further. Thank you! – vfilby Oct 18 '11 at 18:14

One other possibility due to poor notifications from WatchGuard's user interface is licensing issues.

Even if you have manually entered activation codes, some models of XTM will go into single user mode. Only one IP, typically the one logged in as admin user, will be able to go out to the internet.

The Dashboard, SYSLOG entries ("Deny" due to "Internal Policy") and the license activation page will not give a clear indication that the Live Activation must be performed.

Further, WatchGuard's own support will frequently miss this issue while reviewing the configuration details.

share|improve this answer

Your policy for Vince is disabled and that is why it will not allow the port 49627 traffic through. As far as other traffic you have to see what ports are being used. Bigger question is why 49627 out and not using 80?

For example: The 15th Circuit Court of Palm Beach County

They are using 8080 and it is blocked by an internal policy and Unhandled exception packet-00. You have to create a policy for tcp port 8080 and apply it and then the website will show up.

If you have a proxy rule then you can add the site/port/whatever to it. Or you can create a policies for managers\users if you use WSSO for you AD. But that is for a work\corp network

I have seen this all the time and have to do that for certain clients.

I am answering this even though it is old because google still shows this when people search so it may help.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.