Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 20 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 11744 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNAT is not working for Public IP aliases

Sin Master

Hello All

We had a cyber-roam but got burnt so we decided to replace it with XG 115

In Cyberroam we used Virual Hosts to do the PUBLIC IP to LOCAL and was working fantastic.

We tried to Follow Every KB and community thread we find even in this very community but in vain.

 

What we have:

5 Public IP addresses and gateway.

IP 1 in the range is used for Browsing

IP 2, 3, 4, 5 are used for other Services hosted within the network.

We create the aliases in Port2 and we ended up with

Port2:0 IP2

Port2:1 IP3

Port2:2 IP4

Port2:3 IP5

 

And then created a business rule as suggested in the following KB Sophos XG Firewall: How to DNAT to an internal server

And of course we tried all other possibilities Like ANY to ANY

Note:Browsing is fine and all other options are working perfectly (To the extent of usage).

If anyone kind enough to pin point something we missed, I'd appropriate that! I have 4 services down since I switched from my normal router (yeah because Cyberoam burnt)

 

Thank you in advance,



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Sin Master

    So basically there is no traffic matching those conditions. 

    Tcpdump is the "nearest" approach to the interface. In fact XG OS (SFOS) cannot block or do anything on this level. It is Layer 1/2. 

     

    Maybe you filter are not matching.

    Port2 is your WAN interface and Host is your WAN IP ? 

  • 0 in reply to LuCar Toni

    Port2 is my WAN used for browsing and VPN etc...

    Port2:2 (Alias from the range /29) is pointing is the one being used in the rule to point to the server on the LAN segment

    I even used the Port forwarding method for RDP on the main WAN IP
    WAN RDP to Local IP RDP ... also nothing.

    Do yo think changing the subnet to /32 for aliases will help?

     

     

  • 0 in reply to Sin Master

    I do not think, this will help.

    You should see the traffic incoming in a Dump.

    As mentioned earlier, this is the lowest level of communication. 

    If you do not see the traffic hitting on those criteria, there is something wrong in the configuration between XG and your ISP. 

     

    If you perform a tcpdump -ni any host IP  you should at least see something. 

    If not, the traffic is not hitting XG.

     

    Even if you did a mistake in the interface configuration, something should be seen in this Dump. 

     

    Another issue could be the ARP Communication, but i would suggest to dig deeper in this scenario explained above. 

  • 0 in reply to LuCar Toni

    I would look into the ARP Communication as well, I had a similar issue with my deployment where the modem and actually the switches internally did not clear out the MAC address of the old firewall, so the IP's matched up but didn't get through the modem due to the MAC address, once I figured that out I had the same issue with the switches.

     

    Might not be same case here but figured I would share just in case.

  • 0 in reply to Badrobot

    Thank you for your reply Badrobot. Its a fresh installation the ARP is clean.

  • 0 in reply to LuCar Toni

    Hi Toni,

     

    I had to configure another WAN with another gateway on port4 to take the server up and its working fine perfectly.

    All the NAT is not working even when setting a port forwarding rule, except its configured on another port of which are limited to 4 - LAN

     

    I'm really disappointed with this firewall and how xg has turned to.

  • 0 in reply to Sin Master

    I am still not sure, if this is a issue with XG at all. 

    Would assume it is a issue between ISP and Your WAN Connection. 

    How should a product (and i am talking about product, not XG in this case), forward a packet, which is not there at all? 

    I would suggest to call the support to get a debugging. 

  • 0 in reply to LuCar Toni

    That's the point! It worked fine with Cyberoam, TP-Link Router, Pfsense Box, Cisco Router. if with all of those devices it worked why should it be ISP to WAN issue!?

     

    In addition, as I said before the Aliases are the problem they are not being recognized not even receiving a handshake.

     

    All in all, Thank you for your time and support I appricate it, I'll take the issue to ISP/XG dealer to see it through.

     

    Regards,

  • 0 in reply to Sin Master

    But even the Interface is not getting any Packets for this IP. 

    So more the less XG is not sending out the correct ARP, which is easily shown in a dump. Or the ISP is not considering your Interface as the correct interface.

    Both cases would be possible to debug. 

    https://www.thegeekstuff.com/2010/08/tcpdump-command-examples

  • 0 in reply to Sin Master

     The modem is brand new as well?  Or just the XG?