Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 36 replies
  • Answers 2 answers
  • Subscribers 30 subscribers
  • Views 11660 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issues while creating a hairpin NAT

rfcat_vk

Hi folks,

another post on my issues about creating a firewall hairpin nat rule.

I have an NTP server on my network and I want devices to use it as a reference time source. I know the device works when I change network devices to query it for time, they update correctly.

When I built my own firewall rule using a linked NAT rule there was lots of queries to the rule but nothing was returned.

So, I have decided to use the XG build a server access rule.

I think one of the questions in the create wizard is wrong

It asks for the external source networks and devices, but never asks for the internal networks. You can add your internal networks which I did.

Next issue is the reflexive rule automatically created does not use the required service as entered in previous pages, just uses ANY which allows all traffic to bypass the specific NAT and linked NAT rules. Again you can change it to the required service.

Next issue is the created firewall rule appears to be wrong.

Destination zone is LAN but the destination network is the external interface which is a WAN zone.

The result is the rule does not work.

I have tried creating a FQDN for the external internal access to the NTP, but there is nowhere to add it to the rule along with a number of other issues of trying to add another external url for the same address, the XG does not like it.

Please advise what is required to make the hairpin NAT work. I have read the KBA and followed that document and ended up with the above issues.

Ian

.



This thread was automatically locked due to age.
  • 0 in reply to rfcat_vk

    I gave up, hairpin NAT internal to internal does not work from what I can see in the logs.

    Ian

  • 0 in reply to rfcat_vk

    Got it working, but it's very complex I think.

    The dnat assistant cannot solve this.

    Regaring NTP service see this workaround:

     Sophos XG: XG as NTP server – workaround – martinsblog.dk

  • 0 in reply to twister5800

    Hi Martin,

    thank you for the link. The fix assumes you can change the various network device’s ntp server setting, what I am trying to achieve involves redirecting ntp requests to the internal ntp server.

    I am tying to workout some logical way of achieving this, but so far XG fails.

    ian

  • 0 in reply to rfcat_vk

    Did this, its easy but you have to follow certain points: 

    Create a NAT Rule with:

    Source: Your internal Network
    Translated Source: MASQ 

    Destination: ANY
    Translated Destination: Your Internal Server

    Service: NTP

    Firewall:
    Source: All Zones, you selected in NAT
    Destination Zone: (Try first ANY to Test it, after successful tests, change it to your specifics, like WAN Zone or internal Zones etc.). 
    Service: NTP 

    This should cover all the traffic and redirect it to the NTP Server in a transparent manner. 

    You need a firewall rule + NAT Rule, created by your own. 

  • 0 in reply to LuCar Toni

    Hi Lucar,

    there is a flaw with that setup, the ntp server will never update, just loop on itself. The Nat rule needs to be linked and that is where I failed last time. Iwill try again.

    ian

  • 0 in reply to rfcat_vk

    I tried setting up the firewall for the devices to access the NTP sever with your recommended NAT and setup a firewall rule to allow the NTP server access to the internet using the default NAT rule used for general access.

    The only rule that carried traffic was the NAT and that does not get recorded in logviewer even though you can select NAT rule.

    Ian

  • 0 in reply to rfcat_vk

    No, you dont need a linked NAT rule. Instead you need a simple NTP Server to WAN NAT Rule on top. 

  • 0 in reply to LuCar Toni

    Hi Lucar,

    working with Prism, I finally got it working and the result does not look like your suggestion.

    I have asked Prism to write up his solution as a KBA.

    Ian

  • +1 in reply to rfcat_vk

    Hopefully this helps someone in the Future.

    NAT on Sophos XG have some really weird issues, one that got me confused for days has the issue below.

    When you create a NAT Policy to Redirect all traffic to a new Destination, the Zone in which the Firewall handles the Outgoing traffic will change.

    First, look at this picture:

    If you look close at It, you will realize what happened within the Firewall when I've tried to redirect all Outgoing NTP Traffic to a Internal NTP Server.

    The IPv4 that my internal machine is communicating are meant to go for the "WAN" Zone, but instead the Firewall is treating them as the "Server" Zone, which is the Local Zone on where my NTP Server is located - and the same on where my NAT Policy is sending all traffic.

    Here's my NAT Policy:

    If you ever create a NAT Policy which Redirects any Outgoing Traffic for a Local Server, be aware you will also need to create a Firewall Rule which get's applied to the same Zone on where the traffic is being redirect. (But not only that.)

    Which now, we will get to the second issue; Normally you would create a Firewall Rule like this, since you only want to allow traffic to go for your local server and nowhere else;

    This is the Firewall Rule you're expected to create; But It doesn't work.

    Before the NAT get's applied to the Traffic, the Zone of the Outgoing traffic already changed, making the Firewall drop all Outgoing Traffic since It won't match for the "WAN" Zone anymore.

    This is primarily an unnoticed issue, since the default Drop rule of the Firewall have no logging enable.

    In which case, you will need to use "Any" as your Destination Network, since as you can see on the Log Viewer above, the Traffic is not being sent to the "WAN" Zone anymore, but It's being sent to the "Server" Zone.

    By creating a Rule like this: (With your Local Zone.)

    Your NAT Policy which Redirects Outgoing Traffic for a Internal server will finally work.

    And the reason on why the "Destination Networks" is "Any" is because the Firewall doesn't treat that traffic (Outgoing Traffic) as the "WAN" Zone anymore, and since there's no other Policy allowing those "WAN" IPv4 Address for your local Zone (Which in my case is the "Server" Zone), the traffic will be dropped.

    By using "Any", all traffic get's accepted by the Firewall Rule and then after It, the NAT Engine pickups It and send the Traffic for the correct Destination from the NAT Policy.

    EDIT: Finishing up, you will need a Secondary NAT Policy - on top of the NAT Policy which is redirecting the Traffic, this Secondary Policy should be created to make the NTP Server Bypass the Redirect and allow It access to the Internet.

    Here's an ex example on how It should look like:

    Again, hopefully this helps someone in the future, also If someone can rewrite all of this in a better manner, I would be very thankfully for It.

  • 0 in reply to Prism

    Looking at your solution, shouldnt the Server still loop itself with NTP?