Simple DNAT rule created with Server Access Assistant does not work

Show us your interface (Network) settings. 

Hi CarstenDE,

Can you change the inbound interface to Any in matching criteria on the DNAT rule and check if that helps? 

Thanks,

Hello Carsten,

Additionally to what Luca and Harsh mentioned, could you check that the DNAT Firewall Rule is on Top of the Firewall rule list and check if you have any Local ACL created for Device Access (System >> Administration >> Device Access >> Local Service ACL exception rule)

Regards,

does not help:

Should both be ok:

Hello Carsten,

Thank you for the screenshots.

Can you delete the Firewall Rule and recreate it with the same parameters.

Also make sure you don't have any static route configured.

Regards,

Hi,

why do you need an incoming rule to your home assist device, does it not connect through an external server that your application talks to?

Ian

Hi,

HomeAssistant is only an example as it is a webserver and I can simply check with browser if it works.

Mainly I need port forwarding for a WireGuard VPN I would like to build up. I need to use WireGuard, as Sophos SSL VPN does not work. I can connect but the internal IPs are not reachable from VPN. I double checked all settings again and again according to the official How-Tos, but no success. Then I switched to WireGuard but now a simple port forwarding does not work, even though all the settings are exactly like in the docs.

Best regards

Carsten

Hi,

HomeAssistant is only an example as it is a webserver and I can simply check with browser if it works.

Mainly I need port forwarding for a WireGuard VPN I would like to build up. I need to use WireGuard, as Sophos SSL VPN does not work. I can connect but the internal IPs are not reachable from VPN. I double checked all settings again and again according to the official How-Tos, but no success. Then I switched to WireGuard but now a simple port forwarding does not work, even though all the settings are exactly like in the docs.

Best regards

Carsten

Hi,

thank you for the details. Have you created a firewall rule allowing the traffic from the VPN IP range to your LAN range?

Ian

Yes, I did. It was not used. Something is wrong with my box.

As you can see in the pcap above the natted packet is send to the WAN interface but not into LAN. I think that is the root cause. But how can I change that?

That rule would need to be above the one that is directing the traffic to the WAN.

Ian