Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 1937 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

masquerading rules only working after reboot

ek17

Hello,

 

i have a problem with firewall rules that have masquerading configured. It's not working until i reboot the device. If i then disable masquerading, it keeps working until i reboot the device again and so on. That applies even for the WAN masquerading. I've tested this with two devices, a XG106 (SFOS 17.5.5 MR-5) and a XG125 (SFOS 17.5.4 MR-4-1).

 

I verified this with wireshark too.



This thread was automatically locked due to age.
Parents
  • 0

    Are those appliances managed by a Sophos Firewall manager?

    Or did you import those Firewall Rules via API? 

  • 0 in reply to LuCar Toni

    No, they are manged standalone. I've created the rules just with the web interface, no import.

  • 0 in reply to ek17

    Can you show us the Firewall Rule? 

    But never heard of such a issue in a standalone setup.

    You can reproduce this with another appliance? 

  • 0 in reply to LuCar Toni

    I have never tested this out a bunch, but I know when I was first setting up an XG firewall I made some business application rules for dnat to allow specific ips through on sftp and an open rule to allow anyone in to ftp.  Once the rules were done I began testing and it was weird, I could connect but it would take more than a minute to go through then other times it would not connect.  After about an hour of troubleshooting I just thought restart.  I do not know what did it but suddenly everything worked like a charm.  Did multiple restarts after that, tried turning the rules off and on but never seen the same results.

  • 0 in reply to LuCar Toni

    I've tested this a bit further with the XG125 and the masquerading for our WAN:

    1. Opened cmd with ping 8.8.8.8 -t on Server A -> works -> OK
    2. Disabled masquerading on WAN rule, while ping on Server A is still running
    3. Ping from Server A to 8.8.8.8 still works -> NOT OK
    4. Opened 2nd cmd with ping 8.8.4.4 -t on Server A -> doesn't work -> OK

    At this point i have two cmds with running pings on Server A. The one that was started before i disabled masquerading still works (8.8.8.8), while the one that i started after i disabled masquerading doesn't work (8.8.4.4).

    5. Opened cmd with ping 8.8.8.8 -t on Server B -> doesn't work -> OK

    At this point Server A is still getting answers from 8.8.8.8, while server B is not!

    6. Enabled masquerading on WAN rule
    7. Server A still pinging 8.8.8.8 -> still works -> OK again i guess
    8. Server A still pinging 8.8.4.4 -> doesn't work -> NOT OK
    9. Server B still pinging 8.8.8.8 -> doesn't work -> NOT OK

    The firewall somehow remembers what specific traffic had masquerading applied and just keeps going, no matter what i configure.

  • 0 in reply to ek17

    I would say, Point 3 is ok.

    The reason is, XG uses a conntrack to keep connection tracking.

    If you have a open stream (say a ICMP stream from A to B), XG writes a conntrack entry for this connection.

    If you reload / change a specific rule, XG will not kill all connections, instead will prevent all new connections. 

    Actually, this is "normal". You would be able to kill all those connections, if you want to, but most likely this connections will end after couple seconds / minutes and cannot be reopened. 

     

    So basically, depending on the post above, the other points 7/8/9 are also affected by this. 

Reply
  • 0 in reply to ek17

    I would say, Point 3 is ok.

    The reason is, XG uses a conntrack to keep connection tracking.

    If you have a open stream (say a ICMP stream from A to B), XG writes a conntrack entry for this connection.

    If you reload / change a specific rule, XG will not kill all connections, instead will prevent all new connections. 

    Actually, this is "normal". You would be able to kill all those connections, if you want to, but most likely this connections will end after couple seconds / minutes and cannot be reopened. 

     

    So basically, depending on the post above, the other points 7/8/9 are also affected by this. 

Children
No Data