We recently had a customer call saying their internet was completely down at their business.
At first glance everything looked normal:
- The NBN service showed no outages
- The modem lights were on
- The firewall lights were on
- Rebooting the router did not restore internet
So from the outside, everything appeared to be working. But there was still no internet access.
Step 1: Check the obvious things first
When a customer reports no internet, the first things we check are:
- Known outages from the provider (NBN in this case)
- Physical connectivity
- Router or modem status lights
- Restarting the router/firewall
In this case, all of those checks passed. Which usually means the problem is inside the firewall configuration.
Step 2: Log into the firewall
This particular customer was using a WatchGuard firewall.
Once we logged into the firewall management interface, we noticed something important:
The subscription services license had expired.
Normally this should not stop internet access. Most firewalls will continue routing traffic even if the license expires because the license usually only covers additional features such as:
- Web filtering
- Malware inspection
- Advanced threat protection
- Application control
Basic routing and NAT should still work.
However, if certain security features remain enabled after a license expires, they can sometimes block all internet traffic.
Step 3: Identify which feature is blocking traffic
In this case the issue was caused by WebBlocker.
WebBlocker filters web traffic based on categories. When the license expires, the default behaviour can be:
Block all traffic.
Which effectively looks like the internet connection is completely down.
Step 4: Fix the problem in WebBlocker settings
To resolve this issue:
- Log into the WatchGuard firewall
- Go to Subscription Services
- Open WebBlocker
- Go to the Action tab
- Click Edit
- Go to the Advanced tab
- Find the License Bypass section
- Change the setting for when the WebBlocker license expires
Change the setting from:
Block all sites
to:
Allow all sites
Save the change and internet traffic should start working immediately.
This doesn’t only happen on WatchGuard
We have seen similar behaviour on other firewall vendors as well, including:
- Fortinet
- Sophos
In most cases the internet should continue to work when licenses expire, but if license-based security features remain enabled, they can block traffic.
The real takeaway
If your business suddenly loses internet and everything appears normal:
- No ISP outage
- Router lights are normal
- Restarting equipment doesn’t help
The problem may actually be a firewall license that has expired and is blocking traffic.