Rewrite Source Address (Masquerading) Option

Hey SophosNewby 

Would it be possible to please share a screenshot of the firewall rule you are describing.
Also could you explain why you would like to source-NAT this external inbound traffic?

Regards,

FloSupport | Community Support Engineer

This is an inbound Business Application rule for SMTP. I think this is a case of 1 To 1 NAT and that shouldn't be checked, only Reflexive rule.

Hey SophosNewby 

I would leave masquerading for this inbound SMTP rule off as this would cause your SMTP server to see all traffic appearing to be from your single WAN alias IP. I would also advise to create a separate outbound LAN-to-WAN firewall rule for your SMTP server rather than using the reflexive rule option. This would allow for segregation of logging for this outbound traffic and also the ability to select which outbound services your SMTP server is allowed to access.

Regards,

FloSupport | Community Support Engineer

Thank you very much, I was going to ask you for a recommendation on the reflexive rule but from reading these posts, they prefer only one question per post so thanks for that added tip.

And thanks again for your continued help and always responding. :)

So unlike the Business Application Rule, you can't actually choose the alias WAN IP on the User/Network rule for outbound but is that how it works?

Hey SophosNewby 

You can configure your SMTP server's outbound traffic to be NATed to your WAN's alias IP.
Please see the following KB article.

Regards,

FloSupport | Community Support Engineer

Wow you are teaching me so much. Thanks.

So I went from only having a few rules to now 25, adds up quickly when you start controlling both inbound and outbound access independently.  :) I placed my rules now into associated Groups.

So I went from only having a few rules to now 25, adds up quickly when you start controlling both inbound and outbound access independently.  :) I placed my rules now into associated Groups.