Issues while creating a hairpin NAT

Top Replies

• 

  Prism over 5 years ago in reply to rfcat_vk +5 verified

  Hopefully this helps someone in the Future.

  NAT on Sophos XG have some really weird issues, one that got me confused for days has the issue below.

  When you create a NAT Policy to Redirect all traffic to a new Destination, the Zone in which the Firewall handles the Outgoing traffic will change.

  First, look at this picture:

  

  If you look close at It, you will realize what happened within the Firewall when I've tried to redirect all Outgoing NTP Traffic to a Internal NTP Server.

  The IPv4 that my internal machine is communicating are meant to go for the "WAN" Zone, but instead the Firewall is treating them as the "Server" Zone, which is the Local Zone on where my NTP Server is located - and the same on where my NAT Policy is sending all traffic.

  Here's my NAT Policy:

  

  If you ever create a NAT Policy which Redirects any Outgoing Traffic for a Local Server, be aware you will also need to create a Firewall Rule which get's applied to the same Zone on where the traffic is being redirect. (But not only that.)

  Which now, we will get to the second issue; Normally you would create a Firewall Rule like this, since you only want to allow traffic to go for your local server and nowhere else;

  

  This is the Firewall Rule you're expected to create; But It doesn't work.

  Before the NAT get's applied to the Traffic, the Zone of the Outgoing traffic already changed, making the Firewall drop all Outgoing Traffic since It won't match for the "WAN" Zone anymore.

  This is primarily an unnoticed issue, since the default Drop rule of the Firewall have no logging enable.

  In which case, you will need to use "Any" as your Destination Network, since as you can see on the Log Viewer above, the Traffic is not being sent to the "WAN" Zone anymore, but It's being sent to the "Server" Zone.

  By creating a Rule like this: (With your Local Zone.)

  

  Your NAT Policy which Redirects Outgoing Traffic for a Internal server will finally work.

  And the reason on why the "Destination Networks" is "Any" is because the Firewall doesn't treat that traffic (Outgoing Traffic) as the "WAN" Zone anymore, and since there's no other Policy allowing those "WAN" IPv4 Address for your local Zone (Which in my case is the "Server" Zone), the traffic will be dropped.

  By using "Any", all traffic get's accepted by the Firewall Rule and then after It, the NAT Engine pickups It and send the Traffic for the correct Destination from the NAT Policy.

  EDIT: Finishing up, you will need a Secondary NAT Policy - on top of the NAT Policy which is redirecting the Traffic, this Secondary Policy should be created to make the NTP Server Bypass the Redirect and allow It access to the Internet.

  Here's an ex example on how It should look like:

  

  Again, hopefully this helps someone in the future, also If someone can rewrite all of this in a better manner, I would be very thankfully for It.
  Jump to answer