This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DMZ Application not reachable from LAN via Public IP

Hey everyone,

i just setup a DMZ with a Server running a application. From a "outside Network" like my mobile phone its reachable and it is working fine.
When i try to open the App in any Browser from within the LAN like http://PUBLICIP:PORT/ (the certifikate is not rdy yet)
it just does not work.

i'm not sure but i think the sophos is dropping the packets from the inside as soon as they reach the sophos.
when i do some reasearch in the log viewer i get:

(Port 1/2 are the "LAN Bridge" Ports Firewall Rule 2 is the "Deny All" Rule down at the bottom of my firewall rules)

Anyone a idea why this is happening?

This thread was automatically locked due to age.

Parents

0 Keyur over 6 years ago

Hi Rene Böhres

Please refer to the given article- https://community.sophos.com/kb/en-us/133881
Cancel
Vote Up 0 Vote Down

Cancel
0 Rene Böhres over 6 years ago in reply to Keyur

Already tried, tried again and following it step by step.

it doesn't work.

the difference for me is that i set protected zone to dmz instead of lan since the server is in the dmz

as services i used "any"

if i follow your "cause" in that article the problem is:
when the DMZ Server recieves the packet from the LAN Client it reads the internal ip address of the client who requested data.

the DMZ Server tries to sent packets back to the LAN client but the client is on another network

in my understanding the sophos is not routing correctly internally then

so what can i do?
Cancel
Vote Up 0 Vote Down

Cancel
0 Niklas Terhorst over 6 years ago in reply to Rene Böhres

Most SOHO routers don't support hairpin NAT (AKA NAT loopback), which is accessing an internal machine via the external IP, from inside the same LAN.

https://community.sophos.com/products/xg-firewall/f/network-and-routing/73615/how-do-you-create-a-loopback-hairpin-nat-to-an-interface-ip

Check if the solution from this thread helps
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Niklas Terhorst over 6 years ago in reply to Rene Böhres

Most SOHO routers don't support hairpin NAT (AKA NAT loopback), which is accessing an internal machine via the external IP, from inside the same LAN.

https://community.sophos.com/products/xg-firewall/f/network-and-routing/73615/how-do-you-create-a-loopback-hairpin-nat-to-an-interface-ip

Check if the solution from this thread helps
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data