WatchGuard HTTP Is Blocking Access to Field Effect Sensors

Issue:

There has been an update to WatchGuard HTTP Proxy / WebBlocker (October, 2026) that impacts the communication between your network sensor and Field Effect's infrastructure.

Based on our observations, WatchGuard is classifying *.tailscale.com under the "Proxy Avoidance" category, which is set to "block" by default. Because Field Effect appliances use Tailscale for management and operational communications, this classification may prevent the network sensor from reaching Field Effect's infrastructure.

This will result in reduced MDR functionality and/or a loss of service.

We have observed that clients may receive the following error if this issue is effecting them:

Request denied by WatchGuard HTTP Proxy - Reason: Category 'Proxy Avoidance' denied by WebBlocker policy 'Default-WebBlocker'.

Solution:

To restore and maintain normal MDR service, we recommend one of the following approaches:

Option 1 

(Recommended)Create an outbound firewall policy allowing traffic from the Field Effect appliance to Any-External over TCP/443, ensuring that policy is evaluated before any HTTP Proxy or WebBlocker policies that may inspect or block the traffic.

Option 2

Configure exceptions for *.tailscale.com within WatchGuard by:

• Adding *.tailscale.com as a WebBlocker exception
• Adding *.tailscale.com as an allowed domain within the HTTPS Proxy policy (without inspection)
• If DNSWatch is enabled, ensuring *.tailscale.com is allowed there as well

Please note that WatchGuard may classify Tailscale under the "Proxy Avoidance" category by design. However, the Field Effect network sensor must be permitted to communicate with Tailscale services in order to maintain normal MDR functionality.

If you require assistance reviewing your WatchGuard configuration or validating that communications have been restored, please reach out to support@fieldeffect.com for additional support.