Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 28 subscribers
  • Views 530 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG v18 - DMZ challenges

Daniel Bruss

As a quick background, I have been working with firewalls for about 15 years (Cisco PIX, Cisco ASA, and recently SonicWall TZ and NSa).  I have been working on and off with Sophos XGs for about 2 years now so I am familiar with them but they are definitely not my comfort zone.

That said, I am working with a host in a DMZ zone.  I have a NAT rule built for a public IP to translate to the DMZ host.  I have a WAN-to-DMZ access rule that allows tcp/443 to the DMZ host from any outside source.  Boom - that works as expected.

Next, my DMZ host is configured to point to two DNS servers on my internal LAN segment.  I need the DMZ host to be able to resolve some internal systems by name so the DMZ host needs to point to internal servers and not external ones.  I have two DMZ-to-LAN access rules so far.  The first one is a DMZ-to-LAN any-to-any for ICMP.  With that in place, my DMZ host can ping my two internal DNS servers by IP.  My second rule is a DMZ-to-LAN rule that allows my DMZ host to my two internal DNS servers (configured as a group) for the built-in DNS service (tcp/udp 53).  Unfortunately, this is where I am breaking down.  Whenever I try to resolve something by name from my DMZ host, the DNS resolution fails.

What am I missing to make this work?  Would I need a second translate rule between the DMZ and the LAN?  Since I was able to ping from DMZ to LAN, I figured I would not need to do a second translation between DMZ and LAN but maybe that's where I am going wrong.  I also did not configure any explicit access from LAN to DMZ for DNS figuring that the Sophos would be stateful and would automatically handle the return traffic from the initial DMZ-to-LAN DNS request.

Any advice would be appreciated - TIA!



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    what does the logviewer show when you refine the search to the firewall rule you are having issues with? Also where inn the rule list does the DNS rule sit, are there any DNS rules higher than the one in question?

    Ian

  • 0 in reply to rfcat_vk

    Hi Ian,

    I have a DMZ-to-LAN rule configured with my DMZ host as the source and my two internal DNS servers as the destination with the DNS service allowed.  That rule ID is #33.  Further down, I also tried a DMZ-to-LAN rule specifying any source and any destination.  That rule ID is #36.

    All of my DMZ-to-LAN rules have the Log option enabled.  When I pull up Log Viewer and specify my DMZ host as the Src IP, it shows me four denied packets where the destination was going to an IP on my inside LAN but it wasn't either of my two DNS servers.  I have a ping going from my DMZ host to one of the internal DNS servers.  I'm seeing replies but that isn't showing up in the Log Viewer for some reason.

    EDIT:  Once I stopped the continuous ping from the DMZ host to the internal DNS server, that did ultimately show up in the Log Viewer as allowed traffic so that's a good sign.  At this point, I can only think that my DMZ host is trying to use some other DNS server and not the internal one I pointed it to.  I will start digging into that possibility...

Reply
  • 0 in reply to rfcat_vk

    Hi Ian,

    I have a DMZ-to-LAN rule configured with my DMZ host as the source and my two internal DNS servers as the destination with the DNS service allowed.  That rule ID is #33.  Further down, I also tried a DMZ-to-LAN rule specifying any source and any destination.  That rule ID is #36.

    All of my DMZ-to-LAN rules have the Log option enabled.  When I pull up Log Viewer and specify my DMZ host as the Src IP, it shows me four denied packets where the destination was going to an IP on my inside LAN but it wasn't either of my two DNS servers.  I have a ping going from my DMZ host to one of the internal DNS servers.  I'm seeing replies but that isn't showing up in the Log Viewer for some reason.

    EDIT:  Once I stopped the continuous ping from the DMZ host to the internal DNS server, that did ultimately show up in the Log Viewer as allowed traffic so that's a good sign.  At this point, I can only think that my DMZ host is trying to use some other DNS server and not the internal one I pointed it to.  I will start digging into that possibility...

Children
No Data