This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HELP! Compete Astaro/SophosUTM noob...

Hi everyone,

Looking for someone who can either point me in the right direction or give some simple startup help.

I'd like to set up Astaro/SophosUTM and an internal DNS server (WinServer2012) both on VMWare on the same host (which would be dedicated to running only these 2 VMs - the Astaro VM I built from ISO).  The host has 3 NICs (of which I have 2 enabled and both bridged to both my DNS server and my Astaro).  I have an ISP connection via FiOS with a firewall/wireless router they supplied, and a number of switches (for simplicity, let's assume just one with all internal hosts connected to it).

I'm trying to understand the proper architecture for setting this up through VMWare.

In a physical setup (non-vmware), I imagine I'd simply have one box with astaro sitting between my ISP router and my main switch, filtering all traffic between the two to be effective.  I'm not sure exactly where the DNS server would go, but guessing it would be on the internal switch and somehow forward all requests not internal to external dns servers via astaro & my ISP.

In a VMWare world, I'm not really sure how this complicates things, but I'm sure someone with more savvy than I could at least share some basic knowledge and point me in the right direction.

I've looked for documentation, but nothing I've found seems to address the situation where astaro and WinServer2012/DNS/DC/AD run on VMWare and how the NICs & Astaro should be set up (or at least nothing that is clear to me).

Would greatly appreciate any help anyone could provide.

Cheers,
-PR

This thread was automatically locked due to age.

Parents

0 BAlfson over 12 years ago

Post #3:
1.
And if I’m understanding correctly, why am I giving it both Astaro and OpenDNS?

Just in case you need to put something in place of the Astaro - it's just to have a more-robust setup.

From what I read, there are performance and security reasons for using OpenDNS instead of my ISPs DNS servers, so I’m presuming that’s why this is the best practice?

Partially.  And because some ISPs do DNS hijacking and that causes problems with Web Filtering.

3.
By Astaro DNS Proxy do you mean the NetworkServices-->DNS-->Global Tab? It says if you have "an internal DNS Server (for example as part of Active Directory), you should leave this setting empty."

Yes, the consensus is that we disagree with that instruction.

4.
under Advanced I chose Interface=External

I call it Rule #3:
Never create a Host/Network definition bound to a specific interface.
Always leave all definitions with 'Interface: >'.

Post #4
not being able to access the internet.

Do you have a Masquerading rule 'Internal (Network) -> External'?  If so, then Rule #1:
Whenever something seems strange, always check the Intrusion Prevention and Firewall logs.

#3... I went on the assumption here that by "Astaro DNS Proxy" do you meant the NetworkServices-->DNS-->Global Tab, and I added the Internal(Networks) under Allowed Networks.

That needed to be done before trying to add OpenDNS to your internal devices.  Thanks!  - I'll go back to the DNS post and change the sequence (now they no longer match your numbers above).

So where I stand now, aside from not being able to configure the above settings in #1 & #2, it appears my only problem is that I cannot hit the internet on the Win12Server machine (ie, use a browser for an external site). However, I AM able to do this from any machine started within the inner network using DHCP.

If the server is on a different interface of the UTM (DMZ?), then you'll need masq, other rules and 'Allowed networks' entries for that network.  Thanks again - I've also added this to the post.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 PurchaseReceipts over 12 years ago in reply to BAlfson

>>> My only problem is that I cannot hit the internet on the Win12Server machine (ie, use a browser for an external site). However, I AM able to do this from any machine started within the inner network using DHCP.

>>If the server is on a different interface of the UTM (DMZ?), then you'll need masq, other rules and 'Allowed networks' entries for that network. Thanks again - I've also added this to the post.

Ok, so if I understand you correctly, I've made changed such that now I have two Firewall rules:

Internal(Network) --(any)--> Internet IPv4 / Internet IPv6
Server --(any)--> Internet IPv4 / Internet IPv6

And I have 2 NAT rules that say:

Internal(Network) --(any)--> External Interface (Use Primary Address)
Server --(any)--> External Interface (Use Primary Address)

Still no internet access on the Win12Server DNS/AD server. Any other ideas, or did I misunderstand?

Thanks,
- PR
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 PurchaseReceipts over 12 years ago in reply to BAlfson

>>> My only problem is that I cannot hit the internet on the Win12Server machine (ie, use a browser for an external site). However, I AM able to do this from any machine started within the inner network using DHCP.

>>If the server is on a different interface of the UTM (DMZ?), then you'll need masq, other rules and 'Allowed networks' entries for that network. Thanks again - I've also added this to the post.

Ok, so if I understand you correctly, I've made changed such that now I have two Firewall rules:

Internal(Network) --(any)--> Internet IPv4 / Internet IPv6
Server --(any)--> Internet IPv4 / Internet IPv6

And I have 2 NAT rules that say:

Internal(Network) --(any)--> External Interface (Use Primary Address)
Server --(any)--> External Interface (Use Primary Address)

Still no internet access on the Win12Server DNS/AD server. Any other ideas, or did I misunderstand?

Thanks,
- PR
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data