This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Allow a remote user access to one LAN IP/node [SOLVED]

I'm not how to search for this question, please excuse me if it has been answered a few times.

We have contractors that need to remote back into our building and gain access to one server.  I'm not sure what I have done wrong in the setup. When I log in with a test account I can ping the server, but I can not access it's shares

Here's a description of what I have tried.

Sophos UTM 320
Firmware version: 9.313-3

1  I created a user and gave them the access to log into our network, and tested that the account can log in.
2  I then created a host with the IP address of the server I am trying to grant access and a host for the NetBIOS name and FQDN.
3  Then created a group for hosts, that way if I want to expand access I can just create the host/network and add it to the group
4  I then created a firewall rule that only allows access from theSource  user with a Service ofany and a Destination of LAN DNS and the group containing the IP/hostnames of the server.

I appreciate any insight someone might offer.

This thread was automatically locked due to age.

Parents

0 kdawgnc over 10 years ago

Yes, I missed your additional questions, sorry.  I tried connecting via SSL and I can access the servers, all of them.  My test was done with a PC and login account not on the domain, using my test REMOTEUSER SSL account that has the firewall setting of only accessing the one node.

Did you modify the the VPN Poool addressing from the default 10.242.X.0?
     NO, it is still the 10.242.x.0 ip addressing

Did you do the ping test and share access by IP, hostname, or FQDN?
     I can ping the server.
     Shared access was tried by each of those methods.

Did you populate the information at Remote Access > Advanced? Domain Name won't work for for PPTP, but will for SSL.
     Yes, Remote Access>Advanced is populated

Does the network that the test client is on and network the server is on have the same addressing?
     I think I understand the your question, I connected to the network from a mobile hotspot to replicate a real world environment.

In the host definition object for the server, did you bind it to a specific interface?
     Not that I'm aware of...

Used in these configurations:
Network Protection → Firewall → Rules
Remote Access → PPTP → Global
Used by these objects:
01) Network Protection → Firewall → Rules → Any from REMOTEUSER (User Network) to Contract_Diagnostics
02) Definitions & Users → Users & Groups → Users → REMOTEUSER

Remote Access → PPTP → Global

You only have a MASQ rule for Internal(network) to your WAN address, right?
     We have these rules, plus a few more that aren't used:
Internal (Network) WAN
VPN Pool (PPTP) WAN
        VPN Pool (L2TP) WAN

After 5 mins with the attached PC and me navigating my network (being connected with Open VPN on the REMOTEUSER testing account)  These are the firewall results.
rule 27 is 27
Internal (Network)
Log Traffic

Any Source

Any Destination

10:10:21 Default DROP TCP 10.242.13.6 : 50041→ 192.9.211.220 : 8080 [SYN] len=52 ttl=128 tos=0x00
10:10:24 Default DROP TCP 10.242.13.6 : 50041→ 192.9.211.220 : 8080 [SYN] len=52 ttl=128 tos=0x00
10:10:30 Default DROP TCP 10.242.13.6 : 50041→ 192.9.211.220 : 8080 [SYN] len=48 ttl=128 tos=0x00
10:13:17 Packet filter rule #27 ICMP 192.9.211.240 → 10.242.13.6 len=60 ttl=31 tos=0x00 srcmac=00:13:00:3d:39: b8 dstmac=00:1a:00:37:52:b8
10:13:17 Packet filter rule #27 TCP 192.9.211.240 : 3213→ 10.242.13.6 : 139 [SYN] len=48 ttl=127 tos=0x00 srcmac=00:13:00:3d:39:b8 dstmac=00:1a:00:37:52:b8
10:13:19 Packet filter rule #27 TCP 192.9.211.240 : 3214→ 10.242.13.6 : 139 [SYN] len=48 ttl=127 tos=0x00 srcmac=00:13:00:3d:39:b8 dstmac=00:1a:00:37:52:b8

@BAlfson
     Please see attachments
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 kdawgnc over 10 years ago

Yes, I missed your additional questions, sorry.  I tried connecting via SSL and I can access the servers, all of them.  My test was done with a PC and login account not on the domain, using my test REMOTEUSER SSL account that has the firewall setting of only accessing the one node.

Did you modify the the VPN Poool addressing from the default 10.242.X.0?
     NO, it is still the 10.242.x.0 ip addressing

Did you do the ping test and share access by IP, hostname, or FQDN?
     I can ping the server.
     Shared access was tried by each of those methods.

Did you populate the information at Remote Access > Advanced? Domain Name won't work for for PPTP, but will for SSL.
     Yes, Remote Access>Advanced is populated

Does the network that the test client is on and network the server is on have the same addressing?
     I think I understand the your question, I connected to the network from a mobile hotspot to replicate a real world environment.

In the host definition object for the server, did you bind it to a specific interface?
     Not that I'm aware of...

Used in these configurations:
Network Protection → Firewall → Rules
Remote Access → PPTP → Global
Used by these objects:
01) Network Protection → Firewall → Rules → Any from REMOTEUSER (User Network) to Contract_Diagnostics
02) Definitions & Users → Users & Groups → Users → REMOTEUSER

Remote Access → PPTP → Global

You only have a MASQ rule for Internal(network) to your WAN address, right?
     We have these rules, plus a few more that aren't used:
Internal (Network) WAN
VPN Pool (PPTP) WAN
        VPN Pool (L2TP) WAN

After 5 mins with the attached PC and me navigating my network (being connected with Open VPN on the REMOTEUSER testing account)  These are the firewall results.
rule 27 is 27
Internal (Network)
Log Traffic

Any Source

Any Destination

10:10:21 Default DROP TCP 10.242.13.6 : 50041→ 192.9.211.220 : 8080 [SYN] len=52 ttl=128 tos=0x00
10:10:24 Default DROP TCP 10.242.13.6 : 50041→ 192.9.211.220 : 8080 [SYN] len=52 ttl=128 tos=0x00
10:10:30 Default DROP TCP 10.242.13.6 : 50041→ 192.9.211.220 : 8080 [SYN] len=48 ttl=128 tos=0x00
10:13:17 Packet filter rule #27 ICMP 192.9.211.240 → 10.242.13.6 len=60 ttl=31 tos=0x00 srcmac=00:13:00:3d:39: b8 dstmac=00:1a:00:37:52:b8
10:13:17 Packet filter rule #27 TCP 192.9.211.240 : 3213→ 10.242.13.6 : 139 [SYN] len=48 ttl=127 tos=0x00 srcmac=00:13:00:3d:39:b8 dstmac=00:1a:00:37:52:b8
10:13:19 Packet filter rule #27 TCP 192.9.211.240 : 3214→ 10.242.13.6 : 139 [SYN] len=48 ttl=127 tos=0x00 srcmac=00:13:00:3d:39:b8 dstmac=00:1a:00:37:52:b8

@BAlfson
     Please see attachments
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data