LAN not browsing, Remte Access VPN working

Hi Gregory, Thanks for reaching out to Sophos Community.

Lan can't access properly? Did you mean the machines in your VPC can't access the internet or the remote access devices can't access internet after connecting to the Firewall via VPN? 

This is the topology, the FW sits behind a NAT device. So I have configured LAN 192.168.10.0/24 and WAN 192.168.5.0/24. The WAN Iface IP 192.168.5.1/24 is NATted at the VPC edge to a public IP.

Did you try to run a traceroute from the machine in the firewall's LAN and verified? 

Also, you can ping 1.1.1.1 and take a GUI capture on the firewall to see how these packets are forwarded.

Just ensure that the NAT Rule (if v18 or above) is added with MASQ in source NAT for the Outgoing traffic.

ping test from Port1 - LAN

Ping from Port2 - WAN Port

Policy Test

Rules and NAT

Version

Gregory - Go ahead and delete that "Internet" Firewall Rule.  Once deleted, recreate it, but this time set the Source to "Any Host" instead of "local subnet" and do not create a linked NAT.  By default, the "DefaultSNAT IPv4" rule will be used.  You can verify by looking in your log viewer.

You can see it is being used by the traffic going through it on your pic above.

Done that, no linkedNAT, still not able to access net

Or is the fact that the firewall sits behind a NAT device something to address?

Or is the fact that the firewall sits behind a NAT device something to address?

That should not be an issue (Double Natting).  Can you:

1. Generate some traffic from a client machine that is behind the XG Firewall.  Grab its ip address or MAC address.

2. In the logviewer in the XG - open it and set it to the "Firewall" log, then timer filter to 10 minutes.

3. Further filter by the IP or MAC address of the client you used - put a snapshot of that here.  Does the client ip match the firewall and SNAT rule configured?  If not, what firewall rule/NAT rule is it trying to use?

4. Also - can you put a pic of your network interfaces.

Thanks Gregory.