This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall blocks DNAT rule. New to UTM.

Hi All,

First of all I want to say what a great board this is, everyone seems to love helping which is awesome to see!! [:)]

I previously used pfSense and coming to this product is awesome, i am however having problems with DNAT rules. Despite putting in a DNAT rule from External to a host in my network the firewall still blocks the connection.

I have a modem 10.0.0.1 and a nic on the UTM 10.0.2, the gateway for this i 10.0.0.1. The modem is set to DMZ to 10.0.0.2, all incoming connections go to 10.0.0.2. My internal network is 192.168.2.0-255. When i set a DNAT rule from Internet to 192.168.2.202 for port 22 the firewall live log shows 10.0.0.2:22 getting blocked.

Ive attached two screenshots to show what i mean. The arrow points to my connection attempt (made from my phone)

No doubt this is a simple error im making, i am quite new to this and really would appreciate your help if you can.

Cheers
Dale

This thread was automatically locked due to age.

0 FrankBarmentlo over 10 years ago

Can you give us the raw log?
The live log leaves out a little bit of information [;)]

Also, can you give us the log from the Application Control and IPS? I think either one of these is blocking it.

Kind regards,
Frank Barmentlo
Cancel
Vote Up 0 Vote Down

Cancel
0 darrellr_01 over 10 years ago

First thing I can see, you should only be translating in the rule what has changed. So, you should not have a destination service defined. I am not sure that is causing your issue, but something I noticed.
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankBarmentlo over 10 years ago

Could be it,
the 2 fields of the destination translation have only to be used if something changes.
also the traffic selector should be:
any > http > external interface
destination translation should be the host "Ubuntu1".

I missed that in my earlier message(I wasn't awake at that time.. [;)] )
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 10 years ago

You have your DNAT rules wrong. You should configure them for traffic arriving at your external interface (not arriving at your internal machine). This would be something like: External WAN (Address) (Make sure to use the one with (Address) behind it).

Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankBarmentlo over 10 years ago

I've attached an example.
Note:
I do not use IPv6 - you can use "Any" here
2. DMZ is the external interface on my UTM - you should use "your external interface (address)"
Jaguar is my server - you should use "Ubuntu1" here.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

Hi, Dale, and welcome to the User BB!

As the three guys above have said, there are several issues. You might want to read and think about the Rulz up through #5.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankBarmentlo over 10 years ago in reply to BAlfson

Dalew, Any update on this issue?
Cancel
Vote Up 0 Vote Down

Cancel