Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 24 replies
  • Subscribers 27 subscribers
  • Views 2236 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Violation Firewall on traffic from LAN zone to WiFi zone

apijnappels

Okay, I have something strange that I don't seem to get.

I have my normal LAN zone with my Internal Network range. In this zone I have an AP55C access point and the access point in turn has a Wireless network in a separate zone (called WiFi).

I needed to enable traffic from LAN to WiFi zone, so I created a firewall rule:

However, no traffic is hitting this rule. I have checked and double checked zones and networks.

The LAN zone can ping the Firewall address of the WiFi zone. Wifi zone can browse the internet through the XG and all hosts have the XG as their default gateway.

In a packet trace from I see the following information coming back over and over, I try to telnet from the LAN zone client to the WiFi zone client on port 4747 since a service is listening there.

2021-01-07 11:28:40
Port1
wlnet1
IPv4
172.16.16.100
10.20.30.11
TCP
54231,4747
0
0
Violation
Firewall
No policy
No policy
SYN_SENT
2021-01-07 11:28:40
Port1
IPv4
172.16.16.100
10.20.30.11
TCP
54231,4747
0
0
Incoming
No policy
No policy
NONE

There is always 0B in and 0B out on this firewall rule.

I have changed the rule to explicitly allow from LAN any to Wifi any but it doesn't make a difference. Only when I change the rule to Destination any/any then I start to see the byte count increase (because the rule is high in the chain it then captures all internet traffic from WAN), however still the same packet trace with Violation and not possible to send any traffic from LAN to WiFi zone.

Am I overseeing something, or do I need to make some routing changes in the advanced shell for this to work?



This thread was automatically locked due to age.
  • FormerMember
    0 FormerMember in reply to apijnappels

    Hi ,

    Thank you for the update. 

    I have seen this issue before, and if the bridge to AP LAN works but not the separate network, it could be the port 8472 filtered on the internal network. 

    Thanks,

  • 0 in reply to FormerMember

    Tried it now with an unmanaged switch with just XG, AP55C and workstation, still no go, so no port blocking anywhere unless XG does that somewhere.

    Are there any other logfiles I could look into?

    Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

    Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.

  • 0 in reply to apijnappels

    Another point is unanswered.

    If you create a new rule, unrelated to your wireless (LAN to WAN for example), does this rule hit? 

    I want to make sure, you firewall rule set is not broken and each and every newly created rule is broken. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Sorry, overlooked that question completely. Just created a rule as top rule lan/any to wan/any and almost immediately it triggers (counters are increasing).

    Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

    Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.

Cookie Information Banner