Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Subscribers 27 subscribers
  • Views 22609 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG fails to route LAN traffic to WAN

RichardHill

Hi All,

I've had a bit of mare configuring and installing this recently - hence the plethora of questions over the past couple of days. Anyway, I've got to a new stage at the moment.

My network is configured as such:

 

                                                                                     DMZ    10.0.0.16/28

                                                                                                             ^

                          (To be known as WAN)                                 I

Internet <--------> Sky Q Network <---------> Sophos XG <---------> Home Network. 192.168.0.0/24

                                 10.0.0.0/28                      

 

First off, to try and answer any questions...

  • The Sky Q hub is in place for 2 reasons:
    1. Because Sky uses something called MER to authenticate its routers against their network. This is a very uncommon method of connection that's used in place of PPPoE, as a result there are very few routers that can authenticate over it and I don't believe that the XG is one of them.
    2. Sky Q creates a mesh network in your house, all of the satellite boxes actings as rebroadcasts to each other improving your network WiFi coverage. Which is cool. However, they connect to each other over WPS which is very, very bad for security. This, unfortunately, is a non-optional configuration. For those of you that don't know WPS is a form of authenticating wireless devices via the push of a button. This then broadcasts a 0-9, 8-digit pin for other devices to connect to. Unfortunately, authentication over WPS cannot be turned off; so if your router is WPS enabled it means anyone with access to Reaver can get onto your network within a 12 hour period. So, given that Sky has to use this for its satellite boxes; I want to segregate my home network and DMZ away from this vulnerability. Unfortunately, it's a necessary evil.
  • My DMZ is hosting a number of Internet accessible services such as Plex. I want to stop the DMZ accessing the LAN except for the traffic I specify (firewall rules - something I need to configure later on)
  • I want to block all traffic from the WAN (Sky Q) segment of my network accessing my LAN and DMZ; except for that coming directly from the Internet via my Sky Q gateway. (Firewall rules - later config).
  • I have tried the following firewall rules to get traffic to flow from my LAN out my WAN.
    1. Create specific firewall rule allowing traffic out, but not in (basically an attempt at the above).
    2. Create generic "Any->Any Allow" rule to allow all traffic for testing purposes - put this rule at the top of the list.
    3. Turn off all firewall rules.
  • Since writing this; I have found this thread which seems to be a similar issue to mine. I'm not sure if i configured the "Match known users" segment but it's something I will check when I get home. Although given the fact that I turned off all Firewall rules; this should have negated this - unless the firewall is set to "block everything" if there are no rules.
  • I created an omnicast rule that points all traffic (0.0.0.0/0) to my exterior Sky gateway 10.0.0.1/28.
  • I can access the HTTPS configuration page from my LAN segment; traffic just appears to not be able to leave the network.

My questions are:

  1. Please help me get this working. Ask any questions you like.
  2. Does the firewall default to "block everything" if there are no rules defined.
  3. Apart from the "match known users" segment, is there anything else that you think could be causing this issue?
  4. Do I need to do anything with the routing/networking settings? Is my Omnicast rule a pointless and vein attempt to get it working?

 

Any help that you can provide would be greatly appreciated



This thread was automatically locked due to age.
Parents
  • 0

    Let us start with the easy bit first.

    The XG does not pass any traffic without a rule of some sort.

    You need a source (LAN) any zone any host to destination (WAN)  any zone to any host choose your protocol - any service allow with MASQ rule.

    Now I have seen some posts where users have a catchall allowed out at the bottom of their list, me, I have catch what fails the preceding rules and block.

    When you are comfortable with that rule move the next stage.

    Ian

Reply
  • 0

    Let us start with the easy bit first.

    The XG does not pass any traffic without a rule of some sort.

    You need a source (LAN) any zone any host to destination (WAN)  any zone to any host choose your protocol - any service allow with MASQ rule.

    Now I have seen some posts where users have a catchall allowed out at the bottom of their list, me, I have catch what fails the preceding rules and block.

    When you are comfortable with that rule move the next stage.

    Ian

Children
  • 0 in reply to rfcat_vk

    Hi Ian,

    Thanks for the quick response.

    I did create a rule initially that allowed all traffic out of my LAN using the firewall; only to be scanned by the IPS. I disabled all other methods of blocking. This still wouldn't work.

    I then created a rule for investigative purposes only that was an Allow Any->Any with everything turned off; so no IPS scanning, no app blocking etc. I cannot remember if this had the "Known users" segment enabled; but I'm pretty sure that I turned this off too. The main purpose of this was to completely negate the Firewall aspect of the connection. Once I'd proved this connection I could then start to implement a stricter set of rules.

    Unfortunately this failed too. So I disabled all the rules in the firewall to see if that would have an affect. Again; not luck - but if what you're saying is that the XG is basically "always closed unless otherwise specified"; then this would explain why turning off the rules didn't work. However it still doesn't explain why my "Allow Any->Any" rule doesn't work.

    So I have done what you've suggested; however it's still not passing data out of the WAN zone.

    Is there anything that I need to do/should have done as part of configuring the routing side of the XG?

  • 0 in reply to RichardHill

    Hi Richard,

    please post a screen shot of your full rule.

     

    Ian

  • 0 in reply to rfcat_vk

    Will do,

    Do you mean the proper one that I created, the "Any->Any" one or both?

    Cheers,

  • 0 in reply to rfcat_vk

    Hi Ian,

    This is the firewall rule that I've created purely for testing purpose. As you can see it's wide open to anyone and everything. The first image is the top half and the second image is the bottom half.

    I checked and the "Known Users" box was ticked earlier, but I un-ticked it and saved; yet still it's not working. I'm about to restart it to see if that makes a difference.

    Cheers,

    Rich

     

  • 0 in reply to RichardHill

    I've also changed the "Primary Gateway" to the one I've set and re-ticked "Masquerading".

     

    Still no luck.

  • 0 in reply to RichardHill

    Well... Not really sure what I've done... But I've fixed it.

    Haha. Time to get tuning!

  • 0 in reply to RichardHill

    Hi Rich,

    a couple of points

    1/. masq is required, the proxy works differently on the XG to the UTM.

    2/. match known users requires you either use the AD or clientless users which is used to apply specific rules to IP/users.

     

    Ian