This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos unable to route between subnets?

I've got three internal subnets that are attached by two different ports on the UTM, one is directly connected (our internal LAN) and the other two are at a remote location that is connected via router and microwave network) I cannot get both networks to communicate with each other. I created a gateway route for 10.0.0.0/8 to gateway 10.220.255.1 and 192.168.0.0/16 to gateway 10.220.255.1. I am able to ping anything on those networks and 10.220.255.1 from the UTM but not from my internal network 10.50.119.0/24. I have a firewall created for any any. My first call to tech support had me create a masquerading NAT rule but that only allows my 10.50.119.0/24 network to reach the C B networks and not vice versa. My second call to tech support wanted me to create a DNAT rule and a policy route. I guess I'm not understanding why NAT would be needed for any of this. Why is this simple routing not working?

This thread was automatically locked due to age.

0 rrosson over 10 years ago

I would check your routing table on both the UTM and your CB Router. With your CB router having a 10.0.0.0/8 route you might have an issue since your LAN (10.50.119.0/24) is part of that as well as the 10.220.255 IP's that are being used between eth4 and the CB router.

Hope this helps.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

Hi, ammayer, and welcome to the User BB!

You will need no DNAT nor masq rule unless you have some other configuration error.

I think Ron's comment is exactly correct. In your CB Router, instead of 10.0.0.0/8, make a route '10.50.119.0/24 -> 10.220.255.2'. In the UTM, make a route '192.168.?.0/24 -> 10.220.255.1'. You do not want to cover all 192.168 IPs as that will cause routing conflicts in the future should you Remote Access from elsewhere through your UTM.

Cheers - Bob
PS I'm sorry, but I deleted the external link in your post. Please [Edit] that post, click on [Go Advanced] and attach your image to the post. We can't know if that external site is properly protected. The only malware I've gotten in over 10 years was from a link to a picture in this forum several years ago.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 AlanMayer over 10 years ago

Thanks all for the suggestions. I thought routing took the most specific route it matches? For instance a packet coming from 192.168.2.2 would be routed by a static route with a source 192.168.0.0/16 over a route with a source 192.0.0.0/8. I should also mention I had an untangle firewall in this exact set up with the same IP addressing with no issues. Like I said this all works when I apply a NAT rule to the interface.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

I thought routing took the most specific route it matches?

Yes, but you aren't causing WebAdmin to write correct routing instructions for the iptables backend in the UTM. The UTM is much more elegant and powerful than Untangle - it's not Untangle. Like I said, if a NAT rule makes it work, you have a configuration error.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 AlanMayer over 10 years ago

Thanks for help everyone. Come to find out the C B router (another companies) had an incorrect route.
Cancel
Vote Up 0 Vote Down

Cancel

Sophos unable to route between subnets?

Submitted a Tech Support Case lately from the Support Portal?