This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

virtual Sophos FW acting as Internet proxy client computer could not access Internet

Dear All,

I currenty running a virtual sophos FW in esxi with version 19.0.1 MR-1-Build365, and i already have another internet gateway which using palo alto, this sophos i want to act as Internet Proxy, in client computer its will need to have below typed in proxy setting "192.168.111.240" port: 8080 in order to access internet, and in Sophos i have created below 2 firewall rules and NAT rules, when client computer having proxy enable, they can not access internet and none of the traffics hit firewall rule "DNAT Proxy rule", whereas without proxy computer could access internet, just wonder anything i missed ? any help would be appreicated

rule under "Firewall rules"

rule under "NAT rules"

keith

This thread was automatically locked due to age.

0 rfcat_vk over 2 years ago

A quick answer, the proxy does not use the Nat.

ian

XG115W - v19.5.1 mr-1 - Home

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chi Hing Chi Hing over 2 years ago in reply to rfcat_vk

Actually the sophos lan ip is 172.16.16.16 and wan is using 192.168.111.240, this wan ip is at DMZ, behind that it has an internet gateway checkpoint with ip 192.168.111.254, all computer will have proxy configured in their web browser for internet access, to achieve that I need to remove NAT rules in the sophos ? by only creating firewall rule will do ? and does it looks correct to you for the 2 rules I created ? And do I need to remove the linked NAT for this 2 firewall rules ? Please advise and thanks for your assist
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 2 years ago in reply to Chi Hing Chi Hing

Hi,

you don’t need linked Nat rules unless you are translating ports or addresses.

ian

XG115W - v19.5.1 mr-1 - Home

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chi Hing Chi Hing over 2 years ago in reply to rfcat_vk

I been following below steps and it shows that it needs to link with nat, and this is the same case as mine

community.sophos.com/.../steps-to-make-xg-proxy-in-transparent-mode-when-it-is-not-the-gateway
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 2 years ago in reply to Chi Hing Chi Hing

Hi

that article was written before XG had linked NAT available.

All traffic needs to pass through the XG. Your proxy rule needs to be at the top of your rule list. Your NAT rule also needs to be at the top of your NAT list.

Change your any zone to LAN, change your source network to be the network of the LAN not a specific IP address.

Ian

XG115W - v19.5.1 mr-1 - Home

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Chi Hing Chi Hing over 2 years ago in reply to rfcat_vk

Hi,

i did the following and its work as direct proxy, and we have a linux apache server at the back to host the pac file for http proxy excpetion list, and the linux apache server is using ip address 192.168.111.242, this server is for ios devices to use http proxy url as https://192.168.111.240/proxyhk.pac for internet access, if i want to NAT 192.168.111.240 (sophos proxy) to 192.168.111.242 (linux apache) i need to create an NAT to acheive that ? thx for your help

keith
Cancel
Vote Up 0 Vote Down

Cancel