Hello, I have quite a few services running on custom ports on my remote web server. So I tried to open the ports on sophos with these steps: [LIST=1] Open Network protection->Firewall New Rule source -> Lan (Network) Service -> my TCP port Destination -> Any Save [/LIST] And turned on the rule. I then open the live log and can see the connection to the port is green but browser throws "ERR_CONNECTION_TIMED_OUT" error. Attached is the ss from live log. What could be the issue?

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall allows port but connection not established

vijai1996 over 9 years ago

Hello,
I have quite a few services running on custom ports on my remote web server. So I tried to open the ports on sophos with these steps:
[LIST=1]

Open Network protection->Firewall
New Rule
source -> Lan (Network)
Service -> my TCP port
Destination -> Any
Save

[/LIST]

And turned on the rule. I then open the live log and can see the connection to the port is green but browser throws "ERR_CONNECTION_TIMED_OUT" error. Attached is the ss from live log. What could be the issue?

This thread was automatically locked due to age.

0 vilic over 9 years ago

Did you create Masquearading rule for Internal (Network) -> External (Address) ?
Cancel
Vote Up 0 Vote Down

Cancel
0 vijai1996 over 9 years ago

I'm sorry but how do I create that?
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 9 years ago

Network Protection -> NAT. Create new Masquerading rule for Internal (Network) -> External (address).
Cancel
Vote Up 0 Vote Down

Cancel
0 vijai1996 over 9 years ago

Thank you!!! That was a very quick fix. Worked well [:)]
BTW, what does masquerading do?
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 9 years ago

It changes IP address of the local host to UTM WAN IP address before delivering packet to the Internet (and vice versa),
Cancel
Vote Up 0 Vote Down

Cancel
0 vijai1996 over 9 years ago

Thanks once again for helping [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 widdde over 9 years ago

A question;
If a router, firewall and the net behind the firewall has the same net and subnet (192.168.0.x subnet 255.255.255.0) do I need masquerading at all ? Can I use only the firewall capabilites of sophos? Or do I always need masquerading?
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 9 years ago

Usually, UTM is configured with two interfaces, LAN and WAN (not necessary in case of non-firewall related roles like Web Proxy only or WAF only, where only one interface is enough).

You don't need Masq on UTM if the first upstream device from the UTM (default gateway) knows how to route packets back to your LAN. Without Masq UTM will not change IP of the source host.

Please describe your current or planned network topology in more detail.
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 9 years ago

If you want both upstream (WAN) and downstream (LAN) of the UTM to be the same subnet, you should bridge the interfaces.
Cancel
Vote Up 0 Vote Down

Cancel