Norton, oder wer auch immer, blockt Port 8443

[Gerd51]

Bitte entschuldigt, dass ich in deutsch schreibe, aber mein englisch ist nicht so gut.

Ich muss eine Web-Seite über den Port 8443 aufrufen. Ich habe schon alles mögliche versucht. Ich habe den Port in Google Chrome eingetragen und ich habe auch die Firewall deaktiviert. Ich bekomme immer “ERR_CONNECTION_RESET”. Ich habe die Netzwerkaktivität mit Wireshark aufgezeichnet. Da ich die Originaldatei nicht schicken kann, habe ich sie als PDF erstellt. Vielleicht weiß jemand was ich noch machen kann.

BS ist Windows 10 Pro 22H2
Systembuild ist 19045.7725
Browser ist Google Chrome, aber ich habe es auch schon mit Firefox versucht.

Vielen Dank für eure Hilfe
Gerhard Kunz

2026.09.12_Wireshark_Analyse.pdf (66,6 KB)

[bjm]

@Gerd51

Norton, or whoever it is, is blocking port 8443.
I need to access a website via port 8443. I’ve tried everything I can think of. I’ve entered the port in Google Chrome and I’ve also disabled the firewall. I keep getting an “ERR_CONNECTION_RESET” error. I’ve captured the network activity with Wireshark.

• as test, disable SafeWeb/HTTPS scanning (not just the firewall) for 5 minutes and try again.

+++++++++++++++++++++++++++++++++++++++

• fwiw ~ as test: HTTPS scanning – enabled

https://toptip-71.de:8443/login_up.php

++++++++++++++++++++++++++++++++++++++++

Open your browser and try to access:https://toptip-71.de:8443
Does the website load normally once the VPN is turned on, or do you still get the exact same reset error?

Deep Packet Inspection (DPI) by Your Sophos Firewall
Your traffic goes directly through a Sophos gateway device. Sophos firewalls have a security feature called “Deep Packet Inspection” or “HTTPS Decryption”.

• The firewall intercepts the Client Hello packet (Frames 8 and 10) to read what Chrome is asking for. If the Sophos device thinks the destination web server is untrusted, or if the firewall’s own web-filtering policy blocks port 8443, the Sophos device will spoof a reset command and kill the connection.
• How to fix it: If you have access to the Sophos firewall admin panel, check the Web Filter logs or Firewall logs at the exact timestamp of this connection. Look to see if the Sophos device is actively blocking the traffic.

Server-Side SNI Blocking
In Frame 8, your computer sends SNI=toptip-71.de. SNI (Server Name Indication) tells the server exactly which website name you are trying to reach.

• Many servers hosting services on port 8443 are configured to only respond to an exact, specific domain name. If the server is expecting a different name (for example, an internal server name like admin.local:8443 instead of toptip-71.de), it will reject your request immediately.
• How to fix it: Double-check with the provider of the website to ensure you are using the exact correct URL, domain name, or IP address they instructed you to use.

Look at Frames 11 and 12 on Page 2:

• Frame 8 & 10: Your PC sends the TLSv1.2 Client Hello (security handshake).
• Frame 11 & 12: Exactly 11 milliseconds later, the server toptip-71.de responds with a [RST, ACK] packet.

The Verdict
The server at toptip-71.de is deliberately killing the connection because it hates something inside the Client Hello packet sent by Google Chrome.

How to bypass this error right now

1. Use Mozilla Firefox (Easiest Fix)
2. Test via Command Line (cURL)

bash

curl -v -k https://toptip-71.de:8443

Use code with caution.

• -v
• -k tells it to ignore bad or expired security certificates.

3. Change Your Public IP

AI sourced content may make mistakes
Caveat: I’m not behind Sophos gateway

[bjm]

Since the second user can open the page perfectly, but the original poster (OP) gets blocked, the blame shifts entirely to the Sophos gateway found in the OP’s Wireshark log.

Here is exactly what this clue tells us about the block:

1. The Server is Innocent

• The server toptip-71.de is active and accepting connections on port 8443.
• It is not blocking modern Google Chrome browsers.
• It is not throwing a global server error.

2. Sophos is Spoofing the Reset (The Killer Clue)

In the Wireshark logs, the packets are sent to a Sophos device (Dst: Sophos_a8:d1:d0).

• Sophos firewalls use a security technique called TCP Reset Injection.
• When a Sophos firewall rule or web filter decides to block a website, it doesn’t always show a friendly “Blocked” page. Instead, it instantly fabricates a fake [RST, ACK] packet.
• It sends this fake packet back to the computer while pretending to be the website.
• This tricks Google Chrome into thinking the server died, triggering the ERR_CONNECTION_RESET message.

3. Norton is Not the Culprit

The second user proved that running Norton 360 with HTTPS scanning turned on does not break the site. This rules out local antivirus software as the cause.

---

How the OP Can Fix This

Since the local Sophos hardware is actively killing the connection during the TLS handshake, the OP has two options to get through:

• Bypass the Sophos Gateway: The OP needs to disconnect from the local office or home network and connect to a mobile hotspot or an entirely different internet router. This removes the Sophos device from the network path completely.
• Fix the Sophos Firewall Rules: If the OP owns the Sophos device, they must log into the Sophos administration panel. They need to look at the Web Protection or Application Control logs at the exact timestamp of the crash and create an exception rule for port 8443 or the domain toptip-71.de.

+++++++++++++++++++++++++++++++++++++++++++++++++++++

Solution for the OP (Why you get ERR_CONNECTION_RESET)

Your Wireshark log actually contains the “smoking gun,” and it proves that Norton is not the culprit blocking you.

Look closely at the hardware addresses (MAC addresses) in your capture:

• Your PC: TrendtechTec_7:15:d2
• Your Gateway/Router: Sophos_a8:d1:d0

In Frames 11, 12, 23, and 24, the packet dropping your connection ([RST, ACK]) claims to come from the website, but the hardware source sending it is your local Sophos firewall/gateway.

What is happening:

Sophos firewalls use a security feature called TCP Reset Injection. When a Sophos web filter or application rule decides to block traffic (like port 8443), it doesn’t show a block page. Instead, it spoofs a fake RST packet pretending to be the website. This tricks Google Chrome into thinking the server dropped the call, which triggers your ERR_CONNECTION_RESET error.

How to fix it:

1. The Quick Test: Disconnect your PC from your local Sophos-protected network. Connect your PC to a mobile data hotspot using your smartphone instead. Try the site again. It will load instantly because you have bypassed the Sophos block.
2. The Permanent Fix: If you manage the Sophos device, log into the Sophos admin console. Check the Web Protection or Application Control logs at the exact time of your test. You will need to create an exception rule to whitelist port 8443 or the domain toptip-71.de.

AI sourced content may make mistakes
Caveat: I’m not behind Sophos gateway

[bjm]

https://toptip-71.de:8443/login_up.php