This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Portforwarding im internen Netz

Guten Morgen liebe Forenuser,

ich habe ein Problem mit einer Sophos UTM, ich habe einen dyndns Account und möchte darüber meinen Mailserver und eine Synology erreichen.

Ich habe die DNAT einträge gemacht, der Mailserver ist via https auch von außen und innen erreichbar, wenn ich nun aber den Port 5001 für die

verschlüsselte Verbindung als DNAT eintrage komme ich von außen zwar auf die Synology, aber über das interne Netz nicht.

Es sollte so sein das ich beide Geräte auch im internen Netz über die dyndns Adresse erreichen kann, ich habe schon einiges gelesen in den Foren,

hat aber leider alles nichts gebracht.

Habt ihr eine Idee, gerne kann ich euch auch mehr Infos liefern.

Vielen Dank.

MfG

Jochen

This thread was automatically locked due to age.

0 apijnappels over 5 years ago

Entschuldige mich für Antwort in English.

For traffic from internal going to the external interface you need a full NAT rule otherwise it won't work.

Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jochen Barg over 5 years ago in reply to apijnappels

This i have try, but it still doen´t work from internal and external network, too.

Here my screenshots about the rule:
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 5 years ago in reply to Jochen Barg

Do you perhaps have another (D)NAT rule with a lower number than 7) where Datenverkehrsquelle = any and Datenverkerhsdienst = FILESERVER 5001?

If so, try to put your FULL NAT rule higher (for example position 1) and see if that helps.

Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.
Cancel
Vote Up 0 Vote Down

Cancel
0 ThorstenSult over 5 years ago in reply to Jochen Barg

https://www.sult.eu/2017/12/18/warum-full-nat-bei-sophos-utm/
Cancel
Vote Up 0 Vote Down

Cancel
0 Jochen Barg over 5 years ago in reply to ThorstenSult

Sorry but it still doesn´t work from internal, external works fine. Here is my whole NAT list.
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 5 years ago in reply to Jochen Barg

Full NAT on rule 1 needs Internal (Network) not Any IPv4. And I assume that the group Synology includes also the port 5001? Otherwise please show us the edit section of the Full NAT rule 1 and also show what's inside the Synology protocol group.

Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jochen Barg over 5 years ago in reply to apijnappels

Here are the Screenshots, i have Switch to Internal (Network) and it doesn´t work internal.

But you see the HTTP ans HTTPS rules are dnat in my NAT rules, this are working internal and external, why these are going ?

thanks for your Help.
Cancel
Vote Up 0 Vote Down

Cancel
0 Mathias Mühlbacher over 5 years ago in reply to Jochen Barg

Hi there,

I remember that in the beginning I also had such issues - I bypassed them with having a local DNS server which is authorative for my LAN.

As an example this would mean:

WAN: smtp.my-domain.com -> 80.80.80.80

LAN: smtp.my-domain.com -> 192.168.1.10

I have done this and it worked.

I moved to Sophos XG two years ago but still kept the same logic.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jochen Barg over 5 years ago in reply to Mathias Mühlbacher

Hallo Matthias,

ich schreibe mal auf Deutsch, du meinst ich sollte auf meinem Windows Server einen separaten DNS Server installieren ?

Ich habe hier aber eine dyndns Adresse im Einsatz die auf 2 verschiedene Endgeräte zeigt, einmal Mailserver ist Kerio Connect und einmal Synology Filefreigabe Port 5000 und 5001.

Gruß

Jochen
Cancel
Vote Up 0 Vote Down

Cancel
0 Mathias Mühlbacher over 5 years ago in reply to Jochen Barg

Hi Jochen,

ja, du brauchst bei dir im Netz einen DNS-Server, der für DNS-Adresse "autoritär" ist - sprich der deine Zone verwaltet.

Du müsstest also deine dyndns Adresse so einrichten, dass die mit der lokalen IP-Adresse aufgelöst wird.

lg Mathias
Cancel
Vote Up 0 Vote Down

Cancel