This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM9 Driving me crazy!

Hi all, any responses would be greatly appreciated......

We are currently setting up a Hyper-V guest as an MSP but are having trouble routing packets inbound to our DMZ's message relay (MR) on our Software based Sophos UTM9.

We have created a Network Definition within the UTM pointing to our MR (NOT tied to an interface), we have created Service Definitions for the port forwarding, we have created our DNAT rules for the Services (Traffic Selector - Any to Service to External WAN to Destination MR) and we have created our Firewall rules to allow free flowing traffic for the Services.

However, we are not able to Telnet from an external location into the MR through the UTM. We have checked the logs on the UTM and see no record of any packets over the Service ports we have defined yet we do see rejected packets from other external sources, none of which relate to any of our activity.

We have a Draytek Router on the WAN side of the UTM and we have DMZ'd the LAN port on the Draytek which connects the two and are forcing traffic from our designated public IP for this service through this LAN port to the UTM.

I am tearing my hair out over attempting to resolve this issue and I now have very little left, I may have to resort to a wig and pluck at that instead.

Any help would be greatly appreciated. Thanks in advance.

This thread was automatically locked due to age.

Parents

0 jeff.welling over 12 years ago

You've managed to explain quite a lot without actually telling us what the relevant information is.

The IPs we can do without knowing, but what are the ports? Does it pick any random source port like most applications do or does it only use one source port? Are you sure you've configured the service definition properly? Without knowing what the ports are and what you've configured as a service definition, we can't suggest anything.

Make sure that you have Logging turned on for that DNAT rule and any associated firewall rules. When attempting to connect, do you see any related packets at all? If not, then your modem may not be forwarding the packets to the UTM. You could use tcpdump on the UTM's WAN interface to verify this.

Does the service use UDP or TCP? If your service definition is for TCP and the protocol is UDP, this will cause kittens to violently explode. Make sure that we've matched the protocol correctly -- think of the kittens!

Check for any network overlap as well, if more than one interface on the UTM has the same network on it, shenanigans will ensue without the proper configuration.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jeff.welling over 12 years ago

You've managed to explain quite a lot without actually telling us what the relevant information is.

The IPs we can do without knowing, but what are the ports? Does it pick any random source port like most applications do or does it only use one source port? Are you sure you've configured the service definition properly? Without knowing what the ports are and what you've configured as a service definition, we can't suggest anything.

Make sure that you have Logging turned on for that DNAT rule and any associated firewall rules. When attempting to connect, do you see any related packets at all? If not, then your modem may not be forwarding the packets to the UTM. You could use tcpdump on the UTM's WAN interface to verify this.

Does the service use UDP or TCP? If your service definition is for TCP and the protocol is UDP, this will cause kittens to violently explode. Make sure that we've matched the protocol correctly -- think of the kittens!

Check for any network overlap as well, if more than one interface on the UTM has the same network on it, shenanigans will ensue without the proper configuration.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data