Server on Different Interface not Reachable from LAN

Can you show us a screenshot of your interface definition, please?

For clarity reasons, I changed the interface slightly:

It is connected:

And also leases IPs over DHCP:

The firewall rule number 1 should actually allow everything:

Which now seems to work according to the policy tester. I can also ping 172.16.53.53 through the Sophos web GUI, but not directly from my workstation in the LAN zone. I also cannot connect via SSH.

Your interface IP on Port3 seems to be incorrect: are you really using 172.16.53.0 ?

This is the complete network, you should use 172.16.53.1 for Port3 for example. And then your server in that Zone could use  172.16.53.53, if you want. The gateway that your DHCP server for that network will deploy is the 172.16.53.1, then.

After these changes, you setup should begin to fly.

Thank you very much for your answer and your time.

I changed the port3 interface to 172.16.53.1, my server still gets the 172.16.53.53 IP and shows the correct host name under the DHCP lease page, I can still ping through the Sophos Web GUI and the policy tester says it accepts a connection from a LAN IP to the server or from the server to the WAN zone, however from my workstation in the LAN zone I cannot ping the server nor establish an SSH connection.

Am I free to choose the interface IP or did I make an incompatible choice with 172.16.53.1 for the port3 interface?

I changed the interface IP to 172.16.53.1/24 and recreated the DHCP server for this interface - now it works. Thank you very much! It flies now. ;) 

Please read again, you gave 172.16.53.0 to your interface. Not 172.16.53.1 !

The 172.16.53.1 is perfectly ok.

So the two members of your network are 172.16.53.1 and 172.16.53.53. That should work.

If you want to access the WAN zone from your PI_Zone, then you need another fw rule to allow that AND you need to MASQ that zone, because you are coming from a private IPnetwork and access a public network.

For access from the LAN zone you already have a fw rule and don't need to MASQ there. Is your server at 172.16.53.53 having the correct gateway and subnet mask? Please check.

The gateway has to be the interface IP of Port3, which is 172.16.53.1, as per recommendation above.

Please read again, you gave 172.16.53.0 to your interface. Not 172.16.53.1 !

The 172.16.53.1 is perfectly ok.

So the two members of your network are 172.16.53.1 and 172.16.53.53. That should work.

If you want to access the WAN zone from your PI_Zone, then you need another fw rule to allow that AND you need to MASQ that zone, because you are coming from a private IPnetwork and access a public network.

For access from the LAN zone you already have a fw rule and don't need to MASQ there. Is your server at 172.16.53.53 having the correct gateway and subnet mask? Please check.

The gateway has to be the interface IP of Port3, which is 172.16.53.1, as per recommendation above.

Thank you for your reply. After your comment, I changed the interface IP to 172.16.53.1. It started working after this change and recreating the DHCP server. Gateway is 172.16.53.1 (per default).

I didn't specifically MASQ it, but set up the following firewall rules. So far I did not encounter any problems. Should I expect some? Is it bad practice to cover it with the default #NAT_default_network_policy?

NAT policy:

Source: Any host
Service: Any service
Destination: Any host
Source: MASQ
Service: Original
Destination: Original
Inbound: Any interface
Outbound: Any interface

PI_ZONE_TO_WAN firewall rule:

Source & schedule: PI_Zone
Source networks and devices : Any
During scheduled time : All the time

Destination and services: WAN
Destination networks : Any
Services : DNS, HTTP, HTTPS,5353

and LAN_TO_PI firewall rule:

Source & schedule: LAN
Source networks and devices : MAC List
During scheduled time : All the time

Destination and services: PI_Zone
Destination networks : Any
Services : HTTP, HTTPS, PING, SSH, 8888

It only serves internally as a server with some monitoring pages and will act as a DNS-server for the whole network. It won't be accessible from WAN.

Hello,

this looks OK now for me.