Sophos XG Block Inter-VLAN Traffic DMZ

Hi xXTim150Xx,

Thank you for reaching out to the Community! 

Is there any firewall rule between DMZ and LAN zone? Run packet capture to verify if there's a firewall rule allowing the traffic between these two VLANs.

You could create a drop rule between DMZ and your LAN zone and put it on top. 

• Monitor traffic using Packet Capture Utility in the Sophos XG Firewall GUI

Thanks,

Hello xXTim150Xx, 

is there another router between the VLAN 10 (DMZ) and VLAN 1 (LAN)?

Are the interfaces defined in the correct zones?

Sophos XG needs rules for all internal routing.

You can try to figure out what's happening by switching on logging on each rule and tracing a communication from DMZ to LAN in the logfile.

Best regards,
BeEf

Hi H_Patel,

There is no rule which allows traffic from my DMZ to my LAN as you can see in the picture.

I also did a packet capture. I pinged my NAS from the DMZ and I still can reach it. I can also reach it via HTTPs.

My drop rule is already on top of my Firewall Rules.

The interfaces are all in their own Zones (LAN, DMZ).

There is no other router in my network. 

The sophos is also my gateway which is virtualized on proxmox.

All Ethernet Interfaces are connected to the Sophos are bridged with OVS

If I do a traceroute, the way is like: Gateway VLAN10 → Host Network LAN

Can you show me the interace definition? Are there bridges involved?

Unset the policy filter and go through the firewall rules 1 by 1 and do not care about the names. 
There could also be a zone Any or you mixed some things up.

As this is virtualized the cause of the could also lie outside of the firewall or in the physical-virtual "wiring". Without really knowing what's wrong my gut feeling is that this is the reason with a probability of >>50%.

Also look for any rules that contain source any -> network any and replace with LAN and your LAN network.

Ian

Hi xXTim150Xx,

I don't think this is an issue anymore, as running this policy test from your firewall shows that the traffic from VLAN10 to LAN is dropped. 

Reference screenshot: 

Please confirm and update us.

Thanks,

Thank you so much, it's working now.

What was the reason for this behavior?

Hi xXTim150Xx,

Thank you for the update. 

When I looked at your firewall, the rules were already corrected. I think there was a firewall rule configured to allow traffic between DMZ or ANY zone to LAN. 

If you need to test the firewall rules, you can run the policy test to see if traffic is blocked or allowed, you can also see the firewall rule number for allowed or blocked traffic.

Thanks,