NAT rule not allowing traffic if I am at home

You may want to check the box on that rule to log traffic so you can be sure you are seeing it. 

Did you change anything with the NAT or MASQ going out? If you are trying to access the server by its public address, your traffic MASQ may be causing the problem. Can you access the server from home by going directly to its internal address? 

Thank you for the help!  So the weird thing is, the initial "request" seems to be making it through the firewall... here is the screenshot.

Here is an overall screenshot of the rest of my rules... does that help?

Justin,

as I wrote previously, create a LAN to WAN network firewall rule and not a Business Application Rule.

Put the new rule at the top.

Regards

Justin,

as I wrote previously, create a LAN to WAN network firewall rule and not a Business Application Rule.

Put the new rule at the top.

Regards

lferrara, I do not understand how to make a LAN to WAN network firewall rule that will forward port 8445 traffic to my internal server.  Same question I asked last time you posted this answer.  If this is indeed what I need to do, I need help understanding how.  Can you please help guide me?

1. Create a new firewall rule (network rule and not BAR)

2. Source is LAN

3. Destination is WAN and specify the WAN IP you would like to reach

4. Service 8445

4. MASQ OFF.

See, that doesn't make sense.  I think we have confused each other.  My server that I want to reach is inside my network, not outside my network somewhere else.  In other words, the server has a LAN IP address.  The port forward rule I have in place works just fine if I am not at home and want to reach my server.  I simply type http://rutman286home.dyndns-ip.com:8445 into my browser, which resolved to my WAN IP address, and my port forwarding rule takes me right to my server and all is well.  The problem is when I am sitting at home on my network and I want to go to http://rutman286home.dyndns-ip.com:8445 (which points to my WAN IP address at port 8445), that times out rather than making it to my server via my port forwarding rule.  I thought solving that problem would be as easy as making the source zone *any zone*, but that doesn't seem to be working.

Hi Justin,

If XG is the DNS server for the internal devices then add a DNS host entry for server address which will resolve the internal requests to the server. Please refer to, Sophos XG Firewall: How to add a static DNS host entry.

If XG is acting as DNS server for the internal devices then, you are having issues with NAT reflection and to resolve that you might need to configure the following settings:

Configure Business Application Rule > Application Template [DNAT/ FULL NAT]

Allowed Client Network: Configure an IP Host with a Network definition of your internal network (for example, 192.168.1.0/24)

Source Zone: LAN

Destination & Services | Destination Host Network: Choose your hosted WAN interface.

Forward the required ports (you can't do a TCP & UDP forward in one rule, you will need 2 rules, one for TCP ports and other for UDP ports).

Forward To:

Protected Server: Choose the Server host definition

Protected Zone: LAN

Rewrite Source Address: On

Log Firewall Traffic: On

Thanks

Okay i ended up figuring this one out.  It threw me for a look for a while, and I greatly appreciate all of your help!  I ended up having to make separate UDP and TCP DNAT rules.  In SimpleHelp the technician client only connects to the server using TCP.  However, for speed reasons I have all of my clients connecting to the server over UDP... that being a recent change from TCP is what actually caused the problem.  

All is well now.  Thanks again.