Change SSL VPN Port

sachingurung 

this is one of the biggest missing feature that at the moment XG is lacking. This comes from the missing service binding to single IP and not Zone.

At the moment in Sophos you have to options:

• replace the binding zone option to single IP
• Remove the device access and manage XG services using Firewall rules and WAF, so we can use 443 for VPN, User Portal and Web Sites on the same IP

I personally prefer the method 2, but we need groups like on UTM9, where you can create Filter on Firewall and filter per group defined by users, created automatically, etc....

Binding option can be problematic on medium to big installation where customers use WAF for many websites.

Please make sure that this feature is pushed and avaiable as soon as possible. I cannot move some UTM9 installation because primary of this (and other missing features).

As always thanks for your time and support, Sachin.

Regards,

well ok...

but it won't be possible to modify the preconfigured port for the exe download form user portal ?!

really i face abig issue, and i need to Change the port urgent for the SSL, one of the top ISP in egypt block the 8443 and i need to change it urgent, please bring any solution now

Hi,

sorry for late answer. This is indeed a very good question. Unfortunatly I do not really have a good answer to your question.

But as I said, in the current backlog, this implementation is planned as the next change feature for SFOS.

Greetings

Holger

Due to this cannot be a that big issue to implement, and on the other side this is a major showstopper for many cases, I'm really wondering why this cannot be implemented in 16.05... :(

Hi Christian,

let me explain. The complete team, that is reponsible for this issue, is working very hard on bringing IKEv2 for Site-to-Site tunnels into SFOS. So it is just a matter of available resourses.

As soon as IKEv2 is implemented (planned for v17) we will start to make it possible to change SSLVPN port.

Greetings

Holger

Thanks for the above. This was quite helpful as a workaround to get SSL VPN working for me. 

For some reason, my instance of XG did not seem to have the "Non-HTTP Based Policy", so I used the "DNAT/Full NAT/Load Balancing" template with the following settings:

For "Destination Host/Network", #PortB is my WAN port, while "Protected Server" is the LAN IP address for Sophos XG. 

It seems to work OK. 

One thing that surprised me a bit is protocol Selection under "Destination & Services". I would have though there would be an option to forward both TCP and UDP, and not just one or the other, but apparently you can't. Does that mean if I wanted both to be covered off, I would need two rules, one for TCP and another for UDP? That seems rather inefficient and a bit of unnecessary pain. Or did I just miss something to enable both?

I had initially tried UDP but that didn't seem to work behind an offsite firewall, so changed to TCP. When UDP is selected, the User Portal can still be accessed. Unfortunately, where I am they block UDP on 443 apparently, so I had to switch to TCP. Of course, doing this kills access to the User Portal from the internet, which is a bit of an irritation. It can still of course be accessed once the VPN is connected. That being said, if anyone knows a workaround so that both the User Portal and VPN are accessible (other than using 80 for the former), your thoughts would be most appreciated. 

Hi,

I was playing around with VPN SSL and how to change the port.

Good news is: It is possible already.. in the way how the config file looks like :) 

How I figured out?

Go to: VPN --> Show VPN Settings --> Override Hostname

The override hostname is the critical field. Here I needed to put in my Dynamic domain (because I have another router in infront of my Sophos XG before it reaches the internet - yes I have port forwarding there in my fritzbox to the Sophos and after that all the home network devices) ...

I don't know what's in that field for you... anyway here is my example which should work for you as well:

vpn.dyndns.com 6443 #

The 6443 is the port, and before that is a space. After the port is a space and then that '#' character which is interpreted by OpenVPN as a start of a comment.

The line would look this way in the final generated config:

remote vpn.dyndns.com 6443 # 8443

Okay, so it is not really changing the port internally which is used but only the config file.

In my case I load the config file via iPhone from the user portal and there the port 6443 is now configured.

In my fritzbox / router / modem I have port 6443 forwarded to port 8443 to sophos.

It is probably only a workaround which is not possible for everyone.

But it's little workaround which works fine for me. 

Tested with UDP and TCP, Radius auth, + OTP for the VPN connection.

Hope that helps

For the life of me I cannot get this rule to work. I made the exact same rule as above but when i try to connect it fails. in the FW log is see the below.

Check your settings under administration> device access and make sure ssl VPN is allowed. Also, you are writing a DNAT rule. For VPN, you need a regular firewall rule like

Source VPN Destination zone LAN services http etc