WatchGuard Firebox System 4.6 User Guide

Setting up proxy servicesand transmitted, and what actions Web servers and browsers take in response tocommands. For example, when you enter a URL into your browser, you are sendingan HTTP command to the Web server, directing it to find and send you the requestedWeb page.The HTTP proxy does content-based filtering on outgoing connections only, with aset of options that you can easily configure according to your own requirements. TheHTTP proxy does not process incoming connections. In addition, the HTTP proxy canserve as a content filter for Web browsers. For more information, see “Configuringthe WebBlocker service” on page 60.You can use two types of HTTP services:• Proxied-HTTP service allows outbound HTTP on TCP port 80 to be proxiedthrough the Firebox. The proxy has the capability of performing HTTP-specificcontent filtering of each connection. Such content filtering can include denying orremoving “unsafe” content types (such as Java or ActiveX) and performinggeneral verifications on the HTTP exchange.• Filtered-HTTP service allows outbound HTTP on all TCP ports, but incomingaccess only on port 80. Filtered HTTP is filtered by the standard packet filter,which can restrict access by IP address or alias only. No proxy is used with thisservice, meaning that Filtered-HTTP cannot make use of any of the advancedHTTP-specific content-filtering options provided by the proxy. You must useproxied-HTTP if you want accounting logs – for example, byte counts.With either type of HTTP service, you should have a single icon that allows forgeneral outgoing HTTP access (for most internal users) and incoming HTTP access toa limited set of Web servers.The WatchGuard service called “HTTP” is not to be confused with an HTTPcaching proxy. An HTTP caching proxy refers to a separate machine thatperforms caching of Web data.From Policy Manager:1 Double-click the HTTP Proxy service icon to open the HTTP Proxy Propertiesdialog box.2 Click the Properties tab. Click Settings.3 If you are using the HTTP proxy service because you want to use WebBlocker,follow the procedure in the next section. Otherwise, enable HTTP proxy propertiesaccording to your security policy preferences.For detailed descriptions of HTTP proxy options, see the Reference Guide.Zip files are denied when you deny Java or ActiveX applets, because zip filesoften contain these applets.4 Click the Safe Content tab.5 Add or remove properties according to your security policy preferences. Click OK.User Guide 55