How to access vpn client connected to XG firewall SFOS 19.0.0 GA-Build31

Hello jang430,

Thank you for reaching out to the community, could you please refer the following community link to double check the config on v19:
https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/132121/ssl-vpn-ipv4-lease-range-changes-in-sfos-v19

Hi. I've followed the instructions just to be sure, and yet, it's not working.

Just to be clear, it is the PC on the home network (where firewall is at) that cannot access remote NAS (the one that has Openvpn-client installed).

I can see in my firewall I have 1 VPN connection.  I can ping that IP address 10.81.234.X

Do you have a rules in place LAN to VPN and VPN to LAN ?

I have LAN, Anyhost to VPN, Anyhost, Any service

Can you share a screenshot via packet capture utility to determine whether the traffic does pass into the tun0 interface...
Monitor traffic using Packet Capture Utility : https://support.sophos.com/support/s/article/KB-000035761?language=en_US

Can't seem to upload a screenshot.  After turning on packet capture, I've got a table.  I used filter to filter Rule ID 2, which is my LAN to VPN Rule ID, came out empty.

Simply use snipping tool and just try pasting the screenshot, between can you tell us how a packet is travelling? From which interface to which interface ?

Hello jang430, Thank you for the update as we can see the traffic is going out from the Port6 a WAN interface and not from the SSL VPN tunnel i.e. tun0 interface.
Can you provide us the set up config for your SSL VPN and also when the client is connected does it show under the remote users live section ? 

Hello jang430, Thank you for the update as we can see the traffic is going out from the Port6 a WAN interface and not from the SSL VPN tunnel i.e. tun0 interface.
Can you provide us the set up config for your SSL VPN and also when the client is connected does it show under the remote users live section ? 

Yes, when client is connected, I can see it in control center.

Not here, I am talking about  Current activities > Remote users

So now when you originate a ping from your local home network to the remote VPN i.e. LAN to VPN, under the diagnostic > packet capture syntax: host 10.81.234.130 and icmp 

What are the results, please share...

Placed 10.81.234.130 in host field.  

IPV

Interface: Port6 (my LAN interface)

Left size blank

Not here, but as mentioned in the screenshot below
You can also refer the KBA: https://support.sophos.com/support/s/article/KB-000035761?language=en_US

After enabling ping on WAN under administration/ device access, I was able to get the following result.

Does this mean I should be able to access the NAS on the remote end?

Based on the packet capture the packet is being forwarded from tun0 interface i.e. the SSL VPN client tunnel now check with the help of wireshark packet capture whether the NAS is able to receive the traffic and if yes then why NAS isn't responding...

Thank you Vivek Jagad.  I'll do that.  

If the NAS connect to me and gets ip of 10.81.234.2 based on my settings, what is the right way to access the NAS from my point?  Should there be any translation or something on the remote end?  The remote network has an IP of 192.168.1.x.  Maybe this is the reason I cannot access the management portal, though I can ping it.

If NAS connects gets ip of 10.81.234.2, then the following set of rules will be required: 
If you want to communicate from your client IP 192.168.1.x.  to NAS then that would be LAN to VPN

And if NAS wants to communicate to the Sophos LAN then that would be VPN to LAN...