Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=add-local-service-ACL

Add local service ACL exception rule

Use the local service ACL exception rule to allow access to the device's admin services from a specified network or host.

  1. Go to Administration > Device access and click Add under Local service ACL exception rule.
  2. Enter a name.
  3. Select the Rule position.
  4. Enter a description.

  5. Select the IP version from the following options:

    • IPv4
    • IPv6

  6. Select the Source zone to which the rule applies.

  7. Click Add new item to select source networks or hosts. Click Add to create new ones.

    You can select source networks or hosts based on the following options:

    • Country group
    • FQDN host
    • FQDN host group
    • IP address
    • IP list
    • IP range
    • MAC address
    • MAC address list
    • Network

  8. Click Add new item to select the IP address or interface-based destination hosts (for example, user portal) to which the rule applies. Click Add to create new ones.

    Note

    Specifying the destination host enables you to control access to a service (for example, user portal) with a limited set of destination IP addresses.

  9. Click Add new item to select the admin Services to which the rule applies.

    Available options:

    • AD SSO
    • Captive portal
    • Chromebook SSO
    • Clients
    • DNS (For important details, see DNS service.)
    • Dynamic Routing
    • HTTPS
    • IPsec
    • Ping/Ping6
    • Radius SSO
    • RED
    • SMTP Relay
    • SNMP
    • SSH
    • SSL VPN
    • User portal
    • VPN portal
    • Web proxy
    • Wireless Protection

  10. Select an Action.

    Available options:

    • Accept
    • Drop

  11. Click Save.

DNS service

If you select DNS as the admin service, the firewall doesn't directly start responding to DNS requests from the WAN. So, to enable the firewall to respond to DNS requests from the WAN, go to Network > DNS and add a static DNS host entry. Turn on Publish on WAN.

More resources