NAT Rule - mask IP from another subnet

Question

Hi, 
 I ("Rule-Noob") need help with the definition of a NAT rule. We want to communicate with a power storage via Modbus TCP (E3DC storage). On the internal network it all works fine - however the storage drops any communication from another subnet. This is also discussed in other forums if this is a security feature or a bug (?). 
 Anyway. The goal is to be able to communicate with the device from another subnet. However, I fail to set the rule accordingly. 
 We have a Sophos XG310. (Modbus) Client (connected via VPN): 192.168.121.1 => E3DC Storage: 192.168.180.50 via Modbus port 502 
 If I understood correctly, I have to "rewrite" the source address (192.168.121.1) to the 180 network ? 
 grateful for any assistance

emmosophos · Accepted Answer

Hello there, 
 Thank you for contacting the Sophos Community. 
 So some devices do not reply to packets that do not come from their same subnet; this is a security feature, which is why it is recommended to turn off any local firewalls in the devices when troubleshooting. 
 You can take a look at this Recommend Read on how to Masquerade traffic so the device receiving the communication sees it as it&rsquo;s coming from their local subnet. 
 Also make sure you have the correct VPN to LAN Firewall rule in the Sophos Firewall. 
 Regards,

NAT Rule - mask IP from another subnet

Top Replies