I want the UTM's decision for choosing a returning route interface to be wholly based on the incoming source interface it routes in on.
So, I want to create a "triangle-like route" (for lack of better words) configuration using two UTMs, such that: given a public IP user source behind the first UTM, when traffic routes in over interface A on the second UTM its return route out is over interface A, and when it routes in over interface B on the second UTM its return route out is over interface B.
Here is the configuration.
Two Sophos 9.0 UTMs, referred to as S-A and S-B.
Both UTMs have their own default route to the Internet, with public IPs.
Users are behind S-A, using the Public IP subnet 111.1.1.0/24
Protected systems are behind S-B, using the Private IP subnet 10.2.2.0/24
Public Services are served through S-B, using the Public IP subnet 222.2.2.0/24
The "Internet-route" is (S-A)111.1.1.1/24(S-B)222.2.2.1/24 (These are the default routes)
The "Internal-UTM-to-UTM-link" is (S-A)10.0.0.1/30(S-B)10.0.0.2/30
There is one static route on S-A: 10.2.2.0/24 has a GW 10.0.0.1/30
What I want to do.
Case-A: When a user connects to 222.2.2.77, I want the default routes on S-A and S-B to be used for all traffic.
User -> S-A -> Internet-route -> S-B -> 222.2.2.77 -> S-B -> Internet-route -> S-A -> User
Case-B: When a user connects to 10.2.2.88, I want a secondary route between S-A and S-B to be used for the traffic.
User -> S-A -> Internal-UTM-to-UTM-link -> S-B -> 10.2.2.88 -> S-B -> Internal-UTM-to-UTM-link -> S-A -> User
Case-C: A Protected System 10.2.2.88 should use the default route for initiating new connections.
Where I am at now
Of course in both cases, by default, traffic will always go out of UTM S-B the default route. So Case-B does not happen. And If I put in a static route on UTM S-B to make Case-B happen, then Case-A does not happen.
I tried looking into Policy Routes and Multipath rules, but I do not see how I can configured them in the Sophos WebUI to set up the resulting routes I want.
I really want something like Linux's iproute2 rules and routes, so on S-B something like:
ip rule add from 10.0.0.2/30 table internal-route
iproute add table internal-route default via 10.0.0.1/30
Sophos Multipath rules seems to be where iproute2 tables and rules are configured, but it requires me to set up uplink balancing, which I think I should not do as I only have one uplink.
How can I configure this type of "triangle-like" route in Sophos, which the decision for choosing a returning route interface is based on the incoming source interface it routes in on?
This thread was automatically locked due to age.
