Port forward to firewall ip lan or wan

Hello there,

Thank you for contacting the Sophos Community.

What is it that you’re trying to achieve?

Usually, you would use the DNAT rule to give access to a Server behind the XG not to a LAN interface of the XG.

For the Public IP address, in the DNAT rule, you’ll select the Port that has the # and the Public IP  "#Port2 - 100.99.88.77"  (Given Port2 is your WAN) then select the Service that you want to pass down to the Server behind the XG.

Regards,

emmosophosI want to do a dnat to the actual firewall itself, not a server behind it

Hi Sophos User1175,

It seems you have an upstream device.

Could you please let us know for what purpose you're configuring the DNAT rule?

Based on this I'd be able to tell if DNAT needs to be configured to firewall WAN or LAN IP.

all I have is a wan interface ip and a lan interface ip, I just want to know what dnat rule to do, ie to the lan int ip or the wan int ip

I have no upstream device

Hi,

you don't need a DNAT rule unless you are trying to specifically pass to an internal device. When you installed the XG there would have been a default NAT rule created which all you need.

Ian

Hi,

you don't need a DNAT rule unless you are trying to specifically pass to an internal device. When you installed the XG there would have been a default NAT rule created which all you need.

Ian

hi rfcat_vki dont see it, can i create a new one for a certain external ip to access this firewall from WAN

Hi,

you don't need to create  firewall rule or even a NAT rule to access the firewall from the WAN, you enable access in the administration -> device access tab. Though this method is not recommended because of attacks. If you require access to your XG from the WAN I recommend you use the free version of CM. The free version of CM holds 7 days of data and provides remote management of your XG.

Ian

rfcat_vkso there's no way of enabling wan access from a specific source address to this firewall, you can just enable it for any source to this firewall ?

Hi,

if you use CM you do not need to enable WAN access.

Ian

rfcat_vknice, as I have a sophos central account that makes sense

So there's no way to enable https webadmin from a specific source ie wan ip, you can only enable it for any source ie any wan ip

Hi,

there probably is using ACL, but please remember that the traffic hits the firewall external interface before being passed to firewall rules.

Ian

Thanks rfcat_vk

Hi Sophos User1175,

Just adding to what rfcat_vk said,

Refer to the article below to know more information on 'local service ACL exception rule'

Add local service ACL exception rule

Hi,

a suggestion you might like to think about and maybe even experiment with.

You setup an incoming firewall rule with a dnat.

the trick being to set a range incoming that the address and port translation point at the internal interface of the XG. So that way you don’t need to provide wan access to the XG.

ian