Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 2431 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF Rules in V17 to V18

Dan Charles

Previously in V17 firmware I had setup WAF rules so that https traffic to our single external IP was directed to different webservers dependent on subdomains.  This worked really well as I could just specify the subdomain for the service in our public DNS to point to a single external IP and then direct clients to that subdomain.  Also it greatly simplified the set up on the servers as I didn't have to create and redirect custom ports for each of the web servers or direct clients to custom ports.  Also really nice because it redirected port 80 traffic at the check of a button and on some things (exchange....) this is a fair bit more complicated to configure on the webserver. 

This worked like so:


serverA.domain.com > DNS to Public IP > WAN port of firewall > WAF Rule picked up servera.domain.com and 443 or 80 redirected to 443 > SERVER A internal IP (say in the DMZ for instance)

serverB.domain.com > DNS to Public IP > WAN port of firewall > WAF Rule picked up serverb.domain.com and 443 or 80 redirected to 443 > SERVER B internal IP (Say in the LAN for instance)

In the V18 guide it said they were decoupling NAT rules from Firewall rules BUT the migration would auto create NAT rules so that traffic being redirected to internal servers would not break.  Well the above scenario broke.  All traffic bound for 443 is directed to SERVERA or whatever server is highest in the NAT rules list. 

I have a ticket open with Sophos to ask how to restore functionality as above but was wondering if anyone has figured this out? 

The only suggestion so far has been to watch the 30 minute long video on the new NAT functionality and "add the appropriate NAT rules" however no matter what I add to the NAT rules it does not seem to honor the domain in the WAF rules and simply redirects the traffic to a single web server.



This thread was automatically locked due to age.
  • 0

    Hi  

    WAF FW rule do not required NAT/DNAT rule. As XG itself will initiate traffic to end server as in reverse proxy. 

    My suspect based on your detail information:

    Firewall and NAT rule lookup happens independently of each other as per their respective configurations.

    If DNAT and WAF are configured on the same port and DNAT matching criteria are satisfied then DNAT will take precedence. 

    Solution : You may OFF any such matching DNAT rule for configured WAF FW Rule ( if present and ON ) and that will submit traffic to WAF service ( reverse proxy) only via WAF FW Rule.

  • 0 in reply to Vishal_R

    Yes tech support was able to restore functionality by switching off the auto created DNAT rules but its a little scary that the firmware upgrade created a bunch of DNAT rules that broke network flow.  It would be nice if it was going to auto create rules if it would evaluate the flow or check for WAF rules before just dropping things in that would break them.  He literally shut off almost all of the newly created NAT rules... so what was the point in creating them!?

    Now I am trying to sort out why its blocking SMTP traffic despite there being rules in place to allow that to my exchange server before the upgrade.

  • 0 in reply to Dan Charles

    It appears there is an auto created loopback DNAT rule that is creating my issue.  If the rule is disabled HTTPS traffic is going to the proper places and respecting the WAF rules.  However SMTP traffic stops working and does not respect ANY of the firewall rules in place.

    If I enable it SMTP traffic works however all HTTPS traffic is redirected to the exchange server.

    Also the ability to move the rules up or down in the NAT rules list does not appear to work, so i'm unable to tell if simply adjusting the position to below the NAT rules for the exchange and other mail servers will work as I can't move them.  

     

    So far V18 appears to be way more headache than it is worth.