This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAN access through gateway

Ok, so im a complete newbie at this. I have recently installed the Astaro gateway as it was a requirement from our management for security of transfers to and from their datahouse. It is installed on a private yacht and we currently have 4 WAN devices that we use depending on where we are and the services we can pick up.
The initial installation has gone fine and i i have programmed 2 of the internet gateways and have internet on my network. I cannot however access the individual gateways through the Astaro.
My primary gateway is an orange livebox which i have setup with the following ip address:

Local IP: **.**.1.10
Subnet: 255.255.255.0

and within the Astaro

IP address: **.**.1.11
Subnet: 255.255.255.0
GW IP: **.**.1.10

This is set as an ethernet standard connection on eth1

My seconday which is a wired ocean server has a similar setup:

Local IP: **.**.1.40
Subnet: 255.255.255.0

and within the Astaro

IP address: **.**.1.41
Subnet: 255.255.255.0
GW IP: **.**.1.40

the only difference being i have setup a DNS forwarder for the wired ocean server.

Using the tools on the Astaro i can ping all addresses sucessfully but i cannot ping any of them from a remote computer on the network. I also cannot access any of the WAN gateways for administration purposes which in need to do as the connections are managed manually.

Any ideas on why i cannot access them or ping the addresses and how i can resolve this.

This thread was automatically locked due to age.

0 Microsaft over 16 years ago

Do you have setup any packet rules?

Per default nothing is allowed....
Cancel
Vote Up 0 Vote Down

Cancel
0 sussurro over 16 years ago in reply to Microsaft

I setup a rule which allows all packets and this didn't make any difference. I also tried all combinations of ICMP setting and this had no effect either.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago

Have you checked the appropriate boxes on the 'ICMP' tab of 'Network Security >> Packet Filter'?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 sussurro over 16 years ago in reply to BAlfson

I have tried all combinations of icmp settings from this tab on the network security settings but none of them make any difference, i also checked the log and no information from the ping i was sending appeared either as having been recieved by the Astaro or as having been blocked. The Astaro is recieving pings on eth0 which i have on **.**.20.1 i hqave all the correct ranges of network address listed in my windows ip settings so it cannot be that either.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago

The initial installation has gone fine and i i have programmed 2 of the internet gateways and have internet on my network. I cannot however access the individual gateways through the Astaro.

What do you mean when you say you cannot "access the individual gateways through the Astaro?"

When you say that you "have setup a DNS forwarder for the wired ocean server," do you mean that you have a static entry in the Astaro DNS Proxy?

Using the tools on the Astaro i can ping all addresses sucessfully but i cannot ping any of them from a remote computer on the network.

By "remote computer," do you mean one that is connected via VPN, or just one on the network?

Is each gateway in bridged mode? If in routing mode, what is the private IP for each to which the Astaro connects?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 sussurro over 16 years ago in reply to BAlfson

What do you mean when you say you cannot "access the individual gateways through the Astaro?"

I mean that normally these wan devices are accesed and controlled by means of a web browser, by typing in the IP address and logging in.

When you say that you "have setup a DNS forwarder for the wired ocean server," do you mean that you have a static entry in the Astaro DNS Proxy?

The wired ocean server does not use operate in the same way as a standard wan device when it comes to DNS addreses and to get an internet connection the wired ocean local network IP addres has to be added into the tree 'Network Services>DNS>Forwarders'

By "remote computer," do you mean one that is connected via VPN, or just one on the network?

Is each gateway in bridged mode? If in routing mode, what is the private IP for each to which the Astaro connects?

By remote computer i mean one that is connecter to the local network. None of the gateways are in bridged mode and their ip addresses are as follows with the astaro interface settings as listed.

My primary gateway is an orange livebox which i have setup with the following ip address:

Local IP: **.**.1.10
Subnet: 255.255.255.0

and within the Astaro

IP address: **.**.1.11
Subnet: 255.255.255.0
GW IP: **.**.1.10

This is set as an ethernet standard connection on eth1

My seconday which is a wired ocean server has a similar setup:

Local IP: **.**.1.40
Subnet: 255.255.255.0

and within the Astaro

IP address: **.**.1.41
Subnet: 255.255.255.0
GW IP: **.**.1.40

This is also set as an ethernet standard connection on eth2
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago

OK. I think the easiest would be to create a definition and a SNAT for each one:

"Ocean Server" Host **.**.1.40
Source: Internal (Network)
Service: Any (or HTTP if that's all you need)
Destination: Ocean Server

NAT Mode: SNAT

Change Source to: [Interface connected to Ocean Server] (Address)
Change Service to: [Leave this blank since we're not changing it]

Did that do what you need?

Next will be to enable Uplink Balancing. That sounds like an interesting job!

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 sussurro over 16 years ago in reply to BAlfson

I already had definitions and NAT masquerading set up for both and have since tried the SNAT that you suggested but it is still the same. Not sure if this is of any help but when looking at the front of the Astaro, the internal connection has both indicator lights flashing as normal but the two interfaces for my wan devices have only the orange lights flashing and not the green.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago

In such a situation, I suspect that you have Platinum support, so I would suggest submitting a support request. Also, since this is an initial configuration, your reseller should be able to help you. In any case, I'd suggest getting an experienced eye on your situation.

Two other thoughts. Where possible, we prefer to have all modem/routers in bridged mode so that we can put the public IP on the Astaro interface. I'm still confused by the necessity to point at the wired Ocean server as a forwarder - that should not affect how the wired ocean server functions.

Cheers - Bob

PS Important note from Jack Daniels: https://community.sophos.com/products/unified-threat-management/astaroorg/f/58/p/53579/194806#194806

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 sussurro over 16 years ago in reply to BAlfson

I have managed to resolve the problem at last. It was actually the one of the IP addresses listed on my network connection of the network terminal causing the problem. As far as i was aware yon are supposed to have an ip address on your computer that is in the same range as the device that you are trying to connect to but with the Astaro this in not necessary, you only need to have an address in the same range as the internal interface. Any address in the same range as the WAN device will prevent you from connecting.
One thing i have noticed however is that i can only connect to the device that is set as the default gateway. The other devices are hidden unless i set them as the gateway. Would bridging them resolve this?
As for the DNS forwarder for the Wired Ocean server, it is designed for hosting multiple dial up gateways such as VSat, GPRS, etc. It will not pass on the the ISP's dns listing as it is using a dial up uplink but then reroutes to a satellite downlink through our TVRO satellits dish to improve downlink bandwidth and the manufacturers have stated that the locak IP of the server should be used as DNS when it is in use.
Cancel
Vote Up 0 Vote Down

Cancel