Cannot connect over SSL VPN when remote (not connected to local WLAN); cannot connect to admin portal (https://xxxxx:4444) from remote

Hi Shteki 

Will you try by setting up the public IP of ISP modem or router in the override hostname. The NAT device ( ISP router or modem) has to be configured to forward the SSL VPN connection or service port to the XG Firewall. (Default is 8443 if not changed).

If this works then later on you may try by settings up DDNS in the override hostname.

Override Hostname : This sets the SSL VPN client configuration file to use this public IP/hostname when establishing the connection.

docs.sophos.com/.../VPNSettings.html

Hello Vishal_R,

this is the current configuration of SSL VPN.

The IP is the static one from the FW, that it becomes from the ISP router. Should I leave the Override Hostname empty then?

Here are some more setting of the FW. I've also forwarded the 8443 port on the ISP router.

These are the ISP router port forwarding settings:

Hi Shteki 

I checked you are using DynDNS, you may put that DynDNS as well in the hostname and confirm the status ( If this not helpful then set Override Hostname empty and confirm).

Hi Vishal_R,

thank you, it's working now!

Can you also  help me with the problem, why I cannot connect to the admin portal https://xyz.myfirewall.co:4444 from remote, but only to the normal user portal https://xyz.myfirewall.co? You can see that both ports are being forwarded through the ISP router.

Thank you

Hi Shteki 

Configuration seems fine for https://xyz.myfirewall.co:4444 as HTTPS for WAN zone is set to on under admin services.

Please perform below test and collect output to conclude it further:

1) Access https://xyz.myfirewall.co:4444 from outside machine and note down the machine public IP X.X.X.X

2) During access the same from outside, collect tcpdump and drop packet on end machine public IP over XG console option 4.

console> tcpdump 'host X.X.X.X

console> drop 'host X.X.X.X

Please check are you getting any drop. Also share both the result here.

Hi Vishal_R,

The IP Address of my phone (over 4G) was 10.114.240.XXX. I then opened the console on the 135w and entered the code under and simoultaneously tried the https://xyz.myfirewall.co:4444 in Google Chrome on the phone. I received the following code from the console for both commands.

tcpdump 'host 10.114.240.xxx                                           
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode      
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 byt
es                                                                              

drop 'host 10.114.240.xxx     - no results here       

Hi Vishal_R,

The IP Address of my phone (over 4G) was 10.114.240.XXX. I then opened the console on the 135w and entered the code under and simoultaneously tried the https://xyz.myfirewall.co:4444 in Google Chrome on the phone. I received the following code from the console for both commands.

tcpdump 'host 10.114.240.xxx                                           
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode      
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 byt
es                                                                              

drop 'host 10.114.240.xxx     - no results here       

Hi Shteki 

The above indicates packets not reached to XG from your upstream WAN or from ISP cloud.

Now from the same Mobile access user portal which is working from outside and confirm tcpdump on XG, you should get the tcpdump.

Hi Vishal_R,

I tried it with the user portla, which is working, but I'm receiving the same output for both the commands... Am I doing somethign wrong?

Hi Shteki 

Please try to confirm TCPDUMP on admin portal port 4444 and user portal port 443. Save this output in notepad with auto save settings in putty- so if more packets are coming / more request are coming, you may review your end machine public IP request later on by opening it in notepad or via notepad++.

console> tcpdump 'port 4444

console>drop 'port 4444

Hi Vishal_R,

here are two screenshots from a part of the listing of the commands:

For tcpdump 'port 443

for tcpdump 'port 4444

drop 'port 4444 and 443 were empty, no feedback.