Sophos XG NAT for essential services.

Have you tried setting up a DNAT rule based on the service (DNS) to redirect to a new (internal) destination? You'd then have to allow access to the (internal) destination if it wasn't already provided.

You could test with "dig @aaa.bbb.ccc.ddd sophos.com" where aaa.bbb.ccc.ddd is the internal DNS server's address. Once you have the access issue done, you could try the DNAT and see if the redirect happens.

There is also a kba on setting hairpin rules and Nat settings. You will need to search for it in the kbas.

ian

(I tried this at home. I don't have an internal DNS server, so I redirected queries from Google to Cloudflare... except I forgot that since it's leaving my network in both cases, I needed to SNAT MASQ... And for various reasons, I ended up crashing the Sophos. It came back up with the erroneous rule there, and maybe the crash was just because I've been messing with settings all day and finally did one too many things, or maybe it was the lack of MASQ. I've disabled the NAT rule for now.)

I have rule and Nat in place for ntp, but will not be able to post details for a couple of days hence the hint about the kba.

ian