Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 24 replies
  • Subscribers 27 subscribers
  • Views 2181 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Violation Firewall on traffic from LAN zone to WiFi zone

apijnappels

Okay, I have something strange that I don't seem to get.

I have my normal LAN zone with my Internal Network range. In this zone I have an AP55C access point and the access point in turn has a Wireless network in a separate zone (called WiFi).

I needed to enable traffic from LAN to WiFi zone, so I created a firewall rule:

However, no traffic is hitting this rule. I have checked and double checked zones and networks.

The LAN zone can ping the Firewall address of the WiFi zone. Wifi zone can browse the internet through the XG and all hosts have the XG as their default gateway.

In a packet trace from I see the following information coming back over and over, I try to telnet from the LAN zone client to the WiFi zone client on port 4747 since a service is listening there.

2021-01-07 11:28:40
Port1
wlnet1
IPv4
172.16.16.100
10.20.30.11
TCP
54231,4747
0
0
Violation
Firewall
No policy
No policy
SYN_SENT
2021-01-07 11:28:40
Port1
IPv4
172.16.16.100
10.20.30.11
TCP
54231,4747
0
0
Incoming
No policy
No policy
NONE

There is always 0B in and 0B out on this firewall rule.

I have changed the rule to explicitly allow from LAN any to Wifi any but it doesn't make a difference. Only when I change the rule to Destination any/any then I start to see the byte count increase (because the rule is high in the chain it then captures all internet traffic from WAN), however still the same packet trace with Violation and not possible to send any traffic from LAN to WiFi zone.

Am I overseeing something, or do I need to make some routing changes in the advanced shell for this to work?



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to the Community! 

    Can you please show us the wireless network configuration and network definition for both the Internal LAN network and wireless network? 

    Thanks,

  • 0 in reply to FormerMember

    wireless network config

    LAN definition

    I'm not sure what more you need to see from the wireless network, because both the wireless network as well as the wlnet1 interface are exactly the "same screenshot".

  • 0 in reply to apijnappels

    Do you have a SD-WAN PBR Route in place? Is there any? 

    Actually i am just guessing, because the firewall rule should hit. The drop packet capture indicates, it knows both interfaces (wlan and lan) but the firewall rule seems not to hit at all. 

    Maybe you could create a tcpdump on the advanced shell, checking if those packets arrive at those states. But this should still be the case and hit the firewall anyways.

    Just wondering: If you create a new rule (for example LAN to WAN --> Clone your rule above), does this new rule catch the traffic?

    It might be the case, that your framework is broken and all new rules are not getting pushed? There was a very old bug, which could lead to this Symptome. 

    After creating the rules, check the /log/firewall_rule.log 

  • 0 in reply to LuCar Toni

    The new rule (top rule LAN/any to Wireless/any) does not increase counters, stay at 0b.

    Here's output of TCPDUMP

    SFVH_SO01_SFOS 18.0.4 MR-4# tcpdump -ni any host 10.20.30.11 and port 4747
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
    13:31:16.069465 Port1, IN: IP 172.16.16.100.59180 > 10.20.30.11.4747: Flags [S], seq 3351684537, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    13:31:17.071684 Port1, IN: IP 172.16.16.100.59180 > 10.20.30.11.4747: Flags [S], seq 3351684537, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    13:31:19.080490 Port1, IN: IP 172.16.16.100.59180 > 10.20.30.11.4747: Flags [S], seq 3351684537, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    13:31:23.089109 Port1, IN: IP 172.16.16.100.59180 > 10.20.30.11.4747: Flags [S], seq 3351684537, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    13:31:31.097611 Port1, IN: IP 172.16.16.100.59180 > 10.20.30.11.4747: Flags [S], seq 3351684537, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0

    PS, no SD-WAN PBR routes configured

    EDIT: here's the difference in pinging from a LAN host to the wireless host (first 4 packets) and from the XG to the same host.

    SFVH_SO01_SFOS 18.0.4 MR-4# tcpdump -ni any host 10.20.30.11 and icmp
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
    13:44:10.157900 Port1, IN: IP 172.16.16.100 > 10.20.30.11: ICMP echo request, id 1, seq 1768, length 40
    13:44:14.738554 Port1, IN: IP 172.16.16.100 > 10.20.30.11: ICMP echo request, id 1, seq 1769, length 40
    13:44:19.741589 Port1, IN: IP 172.16.16.100 > 10.20.30.11: ICMP echo request, id 1, seq 1770, length 40
    13:44:24.730530 Port1, IN: IP 172.16.16.100 > 10.20.30.11: ICMP echo request, id 1, seq 1771, length 40
    13:44:45.827329 wlnet1, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 0, length 64
    13:44:45.827338 vxlan3.102, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 0, length 64
    13:44:45.868467 vxlan3, IN: ethertype IPv4, IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 0, length 64
    13:44:45.868467 vxlan3.102, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 0, length 64
    13:44:45.868467 wlnet1, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 0, length 64
    13:44:46.827381 wlnet1, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 1, length 64
    13:44:46.827388 vxlan3.102, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 1, length 64
    13:44:46.889810 vxlan3, IN: ethertype IPv4, IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 1, length 64
    13:44:46.889810 vxlan3.102, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 1, length 64
    13:44:46.889810 wlnet1, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 1, length 64
    13:44:47.827421 wlnet1, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 2, length 64
    13:44:47.827428 vxlan3.102, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 2, length 64
    13:44:47.927223 vxlan3, IN: ethertype IPv4, IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 2, length 64
    13:44:47.927223 vxlan3.102, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 2, length 64
    13:44:47.927223 wlnet1, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 2, length 64
    13:44:48.827475 wlnet1, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 3, length 64
    13:44:48.827483 vxlan3.102, OUT: IP 10.20.30.1 > 10.20.30.11: ICMP echo request, id 48666, seq 3, length 64
    13:44:48.947771 vxlan3, IN: ethertype IPv4, IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 3, length 64
    13:44:48.947771 vxlan3.102, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 3, length 64
    13:44:48.947771 wlnet1, IN: IP 10.20.30.11 > 10.20.30.1: ICMP echo reply, id 48666, seq 3, length 64

  • FormerMember
    0 FormerMember in reply to apijnappels

    Hi ,

    It could be the port 8472 blocked between the LAN network and wireless network. Is there a switch? How is your wireless and LAN networks connected? 

    If using Separate Zone networks, port 8472 is also required for separate zone communication. 

    Thanks,

  • 0 in reply to apijnappels

    Could you please disable "firewall-acceleration" on console? console> system firewall-acceleration disable

  • 0 in reply to FormerMember
    H_Patel said:

    Hi ,

    It could be the port 8472 blocked between the LAN network and wireless network. Is there a switch? How is your wireless and LAN networks connected? 

    If using Separate Zone networks, port 8472 is also required for separate zone communication. 

    Thanks,

    Sophos AP55C is connected to same switch as workstation and firewall and all in same VLAN, so there shouldn't be anythiing filtered out.

  • 0 in reply to LuCar Toni
    LuCar Toni said:
    Could you please disable "firewall-acceleration" on console? console> system firewall-acceleration disable

    Unfortunately, with firewall-acceleration disabled the same thing happens.

  • FormerMember
    0 FormerMember in reply to apijnappels

    Hi ,

    Thank you for the update. 

    I have seen this issue before, and if the bridge to AP LAN works but not the separate network, it could be the port 8472 filtered on the internal network. 

    Thanks,

  • 0 in reply to FormerMember

    Tried it now with an unmanaged switch with just XG, AP55C and workstation, still no go, so no port blocking anywhere unless XG does that somewhere.

    Are there any other logfiles I could look into?

  • 0 in reply to apijnappels

    Another point is unanswered.

    If you create a new rule, unrelated to your wireless (LAN to WAN for example), does this rule hit? 

    I want to make sure, you firewall rule set is not broken and each and every newly created rule is broken. 

  • 0 in reply to LuCar Toni

    Sorry, overlooked that question completely. Just created a rule as top rule lan/any to wan/any and almost immediately it triggers (counters are increasing).

Reply Children
No Data