Internet Access for DMZ clients/Server

Question

We have configured DMZ network on Sophos firewall and added some desktops with DMZ network configuration. Computers available in DMZ network can ping DMZ gateway. Firewall rule has been created for internet access on desktops. when we run policy test for this rule it run successfully however, client machine is not able to access internet. is there any addition setting do we need to configure in firewall. We are using SOPHOS XG 230.

This thread was automatically locked due to age.

Vishal_R · Accepted Answer

Hi Hemant Bhoir : Thank you for reaching out to the Sophos community team. Please ensure DMZ to WAN rule is there with the required NAT rule to MASQ traffic over the Internet. If the rule is already there then I would suggest generating PING to any external public IP from a DMZ machine where Internet access is not working and collecting TCPDUMP, drop packet to validate more. Sophos XG Firewall: How to TCPdump https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/114837/sophos-xg-firewall-how-to-tcpdump Sophos Firewall: Monitor dropped packets using CLI https://support.sophos.com/support/s/article/KB-000036858?language=en_US

Internet Access for DMZ clients/Server

Top Replies