Sophos WAF understand

I would think the old DNAT rule take precedence over WAF rules.

discussed often for blocking unwanted traffic using a blackhole-rule (support.sophos.com/.../KB-000038943

But the packetflow-picture shows other details...

community.sophos.com/.../life-of-a-packet---sophos-xg-v18-0

Hello ,
thank you for your reply .
But I don't see how putting a black hole will solve my problem?

Hello,

you can't have both at the same time: a WAF-rule and a DNAT rule for internal servers.

If using WAF, you grab the ports 80 and 443 and then decide with the URL-reference from the calling user-agent where to pass this request to.

You cannot have a DNAT-rule in place for the same ports on that same IP-address.

I understand what you are saying.
What I cannot explain to myself is why the WAF rule does not work when it is before the DNAT rule.
This is mostly what I want to understand

Its the XG Firewall setup, which causes your issue.

The architecture of WAF and NAT come from a unified perspective. In V17.5, NAT was embedded into firewall (Called Business application rule). Therefore a NAT decouple, like in V18.0 still has some tights into this setup, as WAF is still a firewall rule and a NAT rule in one place. But as NAT is decoupled, the system internal NAT rule for WAF is the last one the rule set, you cannot move a DNAT rule below this threshold. Its a limitation within the architecture, which is not resolved yet. But the use case of those NAT rules is not clear to me. Why do you want to have a NAT Rule below the WAF ? This rule, generally speaking, will never be applied. 

Its the XG Firewall setup, which causes your issue.

The architecture of WAF and NAT come from a unified perspective. In V17.5, NAT was embedded into firewall (Called Business application rule). Therefore a NAT decouple, like in V18.0 still has some tights into this setup, as WAF is still a firewall rule and a NAT rule in one place. But as NAT is decoupled, the system internal NAT rule for WAF is the last one the rule set, you cannot move a DNAT rule below this threshold. Its a limitation within the architecture, which is not resolved yet. But the use case of those NAT rules is not clear to me. Why do you want to have a NAT Rule below the WAF ? This rule, generally speaking, will never be applied. 

Hello Lucar Toni.
Thank you for your answer and your explanation.
So this is a bug that is not one we are going to say.
It's not that I need a NAT rule under a WAF rule.
It's just that during my test of the WAF rule I left my WAF and firewall rules active.
So I didn't understand why my WAF rule wasn't working.
Now I have an explanation.

On the other hand I do not see the possibility of putting a geographic restriction in the WAF rule.
Because by default on the incoming service I prefer to limit myself to France.

You can do this geo blocking by using a NAT with unwanted countries and a blackhole destination. 

Hello LuCar Toni,
Last question .
How to access Sophos XG with a WAF rule.
I have tried several things but it doesn't work.
thank you in advance