Use unused ports / other segments

Hi NoName NoName2,

Thank you for reaching out to Sophos Community.

Request to post a snapshot of interface configuration here.

Also, please take below observation, which would help to narrow down the reported issue.

==> Go to Diagnostics > Packet capture

==> Enter BPF string: host 192.168.10.x and proto ICMP

eg: host 192.168.10.5 and proto ICMP

==> Start the capture and initiate a ping from the end machine with the below command.

> ping -n 2 192.168.10.5

Hi NoName NoName2,

Thank you for reaching out to Sophos Community.

Request to post a snapshot of interface configuration here.

Also, please take below observation, which would help to narrow down the reported issue.

==> Go to Diagnostics > Packet capture

==> Enter BPF string: host 192.168.10.x and proto ICMP

eg: host 192.168.10.5 and proto ICMP

==> Start the capture and initiate a ping from the end machine with the below command.

> ping -n 2 192.168.10.5

Your NAS Server Port is not connected. 

yes, I know :-), but I want to ping my gateway before I reconfigure the NAS.

Or is that not possible, if I do reach the gateway, then the rest should actually be as good as working, or?

The Firewall cannot answer, if the port is not plugged in. The linux will not respond to those requests. 

ok, i have pluged in my NAS and configured the ip on my NAS,

but i ihave the same problem. I give my Laptop static a IP from my productive LAN Network and a second IP in the same range e.g. 192.168.20.4.

Can I have a problem with my rules?

I am reviewing the problem with the idea from user Yosh Kathari.

Okay, the recording doesn't work. I have BPF the string

Host 192.168.20.3 proto ICMP

entered.

But I see that my laptop uses an ICMP after 8.8.8.8 as a target in the connection list ??? Why does he do that :-)

Please use BPF string: host 192.168.20.3 and proto ICMP

Ensure that you have different machines located in desired networks.

As Port1, Port3 & Port4 both are part of the LAN zone, one LAN to LAN firewall rule will be required to communicate in-between.

ok, thanks that works fine, i have forgett the word "AND" into my string

Hi,

ok i found my mistake.

I have declared Port4 as a separate zone for my NAS.

Furthermore, I made the mistake of thinking that because my laptop does not know this new network segment, I have to assign an IP from this new segment of PORT4 to my network card.

So he was never able to reach the gateway for the new network segment of PORT4.

I don't have to assign a second IP to my laptop because I know the other network via the existing gateway network (Sophos). If the rule is set up correctly then I should come into my NAS network accordingly.

That works so far.

Now I can limit my services accordingly and also choose the clients that should only have access to the NAS network.

Did I really give that again. ??

greeting

Network Range object or Zone is the same. So it is actually redundant and not needed. Simply use the Zone and it will do the job for you to keep up with the segment.