EBL USG FLEX - whether it works properly

HUBERTKASPRZAK

• Hello, EBL in the H series has a problem with long txt files, I received new firmware, I'm testing it and I'm wondering if EBL should really work like that. After connecting the list, I hoped that the IP addresses from the list would be blocked similarly to security rules, and it works as follows: it passes the address through an open port and then blocks it, informing about the event in Reputation Filter -> Event Category -> External Block List.
• There are no advantages to using EBL

Zyxel_Judy

Hi @HUBERTKASPRZAK ,

and it works as follows: it passes the address through an open port and then blocks it, informing about the event in Reputation Filter -> Event Category -> External Block List.

Are you saying that the H firewall is currently functioning this way, and you believe it’s incorrect?

To better assist you, could you please provide the following information:

• The model name and firmware version of your H firewall
• Your EBL long text file

We’ll then attempt to reproduce the issue and determine the next steps.

HUBERTKASPRZAK

USG FLEX 200H Firmware 1.21(ABWV.0)C0 from 22/07/2024 will not work EBL as described https://community.zyxel.com/en/discussion/22819/usg-flex-h-series-external-block-list as well as the txt file https://lists.blocklist.de/lists/all.txt. I am now testing version V1.21(ABWV.0)ITS-24WK35-0828-240801545 on which EBL file.txt works. I was careful that if I connect the EBL list, it will block all addresses without passing it, a good solution would be for the user to be able to indicate the operation of the list on an incoming or outgoing connection. An incident from today, someone reported a Microsoft server to EBL, I had 700 instances in the Reputation Filter blocking connections to the update server

Zyxel_Judy

Hi @HUBERTKASPRZAK ,

Great to hear that EBL is working for you!

Currently, EBL rules apply to both incoming and outgoing connections. If you'd like more control over your connections, we recommend managing the EBL rules manually.