Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 33 replies
  • Subscribers 29 subscribers
  • Views 21005 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VM setup for XG Firewall Home Edition

RayGo1975

I am using ProxMox VE on an HP pavilion laptop with one internal NIC and a USB-NIC adapter.

In my ProxMox setup I have the internal NIC (eno1) bridged to vmbr0 and the USB-NIC (enx.....) bridged to vmbr1. In creating the VE for Sophos XG Firewall Home Edition I have 6 GB of memory, 64 GB of disk space and two Network Interfaces, net0 (vmbr0) and net1 (vmbr1) see attached screen shot of the VM configuration.

In the e-mail I got with my serial number it says:

1. Install the downloaded image on your preferred hardware or virtual environment (Note the installation will overwrite the previous operating system and all files).

2. Connect the WAN interface (port 2) on the device to your internet connection.

3. Connect a computer to the LAN interface (port 1) and access the setup screen at 172.16.16.16:4444 (Note: It may take a few minutes for the necessary services to start before the setup screen is ready)

I have done number one. but I have not figured out which interface is port 1 and which is port 2. I have tried plugging the internal NIC (eno1) into my router and the USB-NIC into my laptop I am using to manage the VM. That did not work so I tried it the other way around, still no luck. 

When I try to go to the IP address given I get "This site can't be reached". 

You really need to write some instructions for the home user who is clueless about networks and things related to firewalls.

Here is a screen shot of my ProxMox network setup:

Any and all help is greatly appreciated.



This thread was automatically locked due to age.
Parents
  • 0

    Hi there,

    The first thing I notice is that both you WAN IP and LAN IP on on the same subnet.... it might just be for testing but the firewall needs to be configured as a router so you would have to have the LAN on another subnet at least  eg. 192.168.2.X or 3.X.

    I assume you are going this as you are testing the firewall inside your existing network... this will work but know that you are creating a double NAT situation so some stuff is a lot harder to configure with double NAT. (eg...VOIP)

    Secondly I notice that you have configured your NICS on Promox as e-1000 network cards....did you do that because the other didnt work?   the default should be virtio as these use way less resources and work well.

    You are not alone being frustrated knowing which port is lan and which is wan...once you get access to the GUI you only get Port1 and Port2 as descriptions,   the easiest way to figure out what is what is to unplug one and configure the WAN first....you can use the console within proxmox and then use the menu options within Sophos to configure the WAN interface IP.

    Hope this helps

  • 0 in reply to TrevorSymonds

    Thank you for your response. I am learning more and more about networking as I go about this project.

    TrevorSymonds said:
    The first thing I notice is that both you WAN IP and LAN IP on on the same subnet.... it might just be for testing but the firewall needs to be configured as a router so you would have to have the LAN on another subnet at least  eg. 192.168.2.X or 3.X.

    I have changed the static IP for the USB-NIC to 192.168.2.202. 

    TrevorSymonds said:
    I assume you are going this as you are testing the firewall inside your existing network... this will work but know that you are creating a double NAT situation so some stuff is a lot harder to configure with double NAT. (eg...VOIP)

    No VOIP or other complicated network issues, this is a simple home network.

    TrevorSymonds said:
    Secondly I notice that you have configured your NICS on Promox as e-1000 network cards....did you do that because the other didnt work?   the default should be virtio as these use way less resources and work well.

    I have changed the NICS to virtio, just a case of not knowing what the heck I am doing.

    TrevorSymonds said:
    You are not alone being frustrated knowing which port is lan and which is wan...once you get access to the GUI you only get Port1 and Port2 as descriptions,   the easiest way to figure out what is what is to unplug one and configure the WAN first....you can use the console within proxmox and then use the menu options within Sophos to configure the WAN interface IP.

    That gets into how do I get to the Sophos GUI? I have plugged the firewall directly into my other laptop and tried to go to 192.16.16.16:4444 as instructed in the e-mail that came with my serial number. Do I also need to disable my wireless card on the connected PC so it only can see the Firewall? I have not tried that yet.

  • 0 in reply to TrevorSymonds

    Okay here is what my sophos hardware tab looks like after adding a third nic

    and here is my PVE network setup

    Also here is what my physical setup looks like, solid lines are wired and dashed line is wireless. I did not mark it but my router is at 192.168.1.1

    The PVE laptop also has a wireless NIC but I have not been able to get it to work so I left it out.

    I know that once I get it setup and configured that the PVE laptop will have the WAN plugged into my modem and the LAN will be plugged into my router where the modem plugs in now.

  • 0 in reply to RayGo1975

    Ok thanks for that....I see another error/problem..... You have turned the firewall on...meaning you have a firewall in front of the firewall....so you will not every get to the GUI.

    You need to click on your sophos vm....then goto option in firewall and make sure that it is set to "NO"

     

    Here is mine:

    Its hard enough to set up sophos you definelty dont want this on!!!

  • 0 in reply to TrevorSymonds

    I will do that... that is what you get for working with someone who has no clue what they are doing.

  • 0 in reply to RayGo1975

    Firewall was set to no, did not need to change it.

  • 0 in reply to RayGo1975

    Give yourself some credit....you have done amazingly well to get proxmox up and running as it is not easy.   When you throw sophos into the mix, its rocket science

  • 0 in reply to RayGo1975

    Ok...mmh so when you click on hardware on the Sophos VM and look at the NICS.....if definelty DOES NOT say Firewall=1?

  • 0 in reply to TrevorSymonds

    On the hardware tab it does say firewall=1 for the NICs but in sophos firwall>options it says no

  • 0 in reply to RayGo1975

    I may have found it. in the PVE firewall>options it said yes. I changed it to no and am rebooting.

  • 0 in reply to RayGo1975

    This is strange. both PVE>firewall>option and sophos>firewall>option are set to no. but even if I delete the NICs in sophos and put them back in they come back as firewall=1. 

  • 0 in reply to RayGo1975

    found it... when you go into edit the network device on sophos there is a little check box that is labeled, firewall. as soon as I unchecked it the firewall=1 went away.

    going to try the ping test again.

Reply Children
  • 0 in reply to RayGo1975

    You might have to restart sophos....when you change stuff on the VM nics.....sometimes it doesnt take till you shutdown the VM and restart it....

    But as long as the sophos VM doesnt say firewall=1 after reboot or after NIC change you should be OK

  • 0 in reply to RayGo1975

    I really hate to say this but the ping test failed.

    I had all three network devices on sophos set to vmbr1. started the sophos VM and started a never ending ping to 172.16.16.16 on my control PC

    I then changed each network device from vmbr1 to vmbr0 one at a time and waited for at least three timeout messages on the ping. never got a successful ping reply.

    I will be sitting down to dinner soon and I will not be able to get back to this until tomorrow afternoon around 1:00 PM EDT.

    I can not thank you enough for all the help you have given me. And the knowledge you are imparting.

  • 0 in reply to RayGo1975

    Go and take a break....you might think of something... one thing think that you can try is setting the IP on the CLI, meaning in the proxmox console... this will allow you to set the IP for the LAN interface to match you 192.168.1.x network....  another easy option is to set up a small linux VM with a desktop on proxmox and give it access to the same vmbr0 interface.... then you can connect using the included firefox.... then you dont even have to worry about network cards...as it will all be internal to proxmox....

    I have been running Sophos for about 7 years.....and proxmox for about 5.... never had a single failure or blip....runs great....so its well worth the effort if you can get it running.

  • 0 in reply to TrevorSymonds

    Hi,

    just did my first installation from an ISO for the first time in many XG releases and discovered there is now a lot of functionality in the CLI that wasn't there last time I installed from an ISO>

    Ian

  • 0 in reply to TrevorSymonds

    Some questions on your suggestions.

    TrevorSymonds said:
    one thing think that you can try is setting the IP on the CLI, meaning in the proxmox console... this will allow you to set the IP for the LAN interface to match you 192.168.1.x network.

    Do you mean set the eno1 to a static IP address in the /etc/network/interfaces file? Also should it be the same IP as the bridge vmbr0 or different?

    TrevorSymonds said:
    another easy option is to set up a small linux VM with a desktop on proxmox and give it access to the same vmbr0 interface.... then you can connect using the included firefox.... then you dont even have to worry about network cards...as it will all be internal to proxmox.

    I now have an ubuntu VM using the vmbr0 bridge as it's NIC. It took forever to install...

    Not sure what you mean by

    TrevorSymonds said:
    then you can connect using the included firefox
    as I would still need my control PC to get to the Ubuntu VM console. Is there a way to bring the Ubuntu console up on the PVE PC?

    adding a third machine is a little confusing.

    Please remember I am running this on an old laptop and it is stressing my CPU running any VM under proxmox.  I keep getting messages about my core temperature going above the threshold and being throttled back. just do not want it to catch on fire.

    I may have to buy a used desktop at a garage sale or swap meet and put this on hold until then.

  • 0 in reply to RayGo1975

    If you login to the cli you should see this:

    If you select 1 and follow prompts you can set the LAN ip address to something within your range.  (Avoid using Advanced Shell as much as possible)

    Option2

    Ubuntu would be great, no need for third VM... just Sophos VM and Ubuntu VM.... when in Ubuntu then open any browser and connect to the Sophos web gui.... as the Ubuntu VM and the Sophos VM are on the same NIC there should be no reason why ubuntu can not see sophos as long as they are both on the same vmbr0 (NIC) .... once you have configured Sophos you can delete the Ubuntu VM as you will no longer need it. Just make sure that Ubuntu has an ip in the same range as sophos default (172.16.16.X)