Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 3 subscribers
  • Views 4186 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNAT config issues when blocking access to internal network from VPN

P M
Hi guys,
 
Hope this finds you well, 
 
I'm having issues configuring a DNAT correctly.
 
The end goal is to create a full tunnel SSL VPN profile that has access out to the internet only, denying all connections to the local network. This topic has been broached in the community here before but everything I've found isn't working for me.
 
As I understand it, from reading through the relevant topics is, the "Internet IPv4" network definition in the SSL VPN profile routes all traffic through the UTM so a full tunnel is created, and the job of the DNAT is to black hole the packets destined for the internal network before they hit the VPN config, based on rulz. So when set up correctly, the DNAT should reroute the traffic into this black hole before the VPN config gets the chance to route requests to the internal network, and that because there is an order of preference to the way packets are handled, this is the only way to achieve the desired result before the VPN routes the traffic itself, meaning that firewall rules would be ineffective.
 
However, I have tried to configure this every which way I can think of now, and have so far been unable to get the desired result I'm looking for.
 
I currently have a full tunnel set up* but i can't prevent internal network access. Any help with this would be greatly appreciated.
 
(*IP and WebRTC both change, but my DNS is leaking on windows 10, I think this is because of the new way windows handles DNS, as I get a full tunnel on my iPhone. Any thoughts?)
 
 
Below is my current configuration and explanation as to why the settings are there - If anything is wrong please let me know, I have included this firstly so if i misunderstand anything you guys can tell me, and secondly as a reference for anyone who may find it useful in the future.
 
SSL VPN profile:
users and groups: VPN user group A (using a group so users can be added and removed from the group easily and will inherit all the correct settings.)
Local Networks: Internet IPv4
Automatic firewall rule checked
 
This creates the routing for the full tunnel so all traffic passes through the UTM.
 
 
Web filtering Local networks: added VPN user group A network
 
This gives the VPN user benefits of web filtering in exchange for a little overhead.
 
 
Masquerading NAT: VPN user group A network>External WAN interface
 
This gives the VPN user group access to the internet via the external WAN interface (the benefits of using Masquerading NAT is your external IP can change and your NAT won't be affected)
 
 
NAT:
Position: 1
Rule: DNAT
From: VPN user group A network
Service: Any
Going to: Internal network
 
change to: black hole (random 'host' IP, unused private address 10.255.255.15)
service left blank
Automatic firewall rule checked
 
Supposed to drop traffic going to the internal network from the VPN profile, but its still getting through currently.
 
 
Some wider configuration for context:
- A second SSL VPN profile for split tunnel access to internal network only is set up and working correctly. This is a remote box so no suggestions that kill my access please :D
- UTM is nested behind a router so double NATing is occurring. However full tunnel internet access works as intended, as does VPN etc. The issue is disabling local network access, but i mention just in case.
 
 
Is my current understanding about how this all should work correct?
Can you see where I'm going wrong here?
Is there any best practice i'm missing?
 
 
Thanks for your help


This thread was automatically locked due to age.
Parents
  • 0

    Hi, P M, and welcome to the UTM Community!

    If you haven't added the LAN to 'Local Networks' in the SSL VPN Profile, you shouldn't need that DNAT.  Which IPs are being reached, where are they and what test reveals them as reachable?  If it's a ping, what happens if you test after de-selecting 'Firewall forwards pings' on the 'ICMP' tab of 'Firewall'?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Hi Bob,
     
    Thanks very much and thanks for the comment,
     
    Ok thats interesting, Internet IPv4 is the only network definition in local networks on that SSL VPN profile.
     
    I have full blown HTTP/HTTPS access to the internal network with this VPN profile, i have an ESXi host and a managed switch on the inside among other things and the webpages load up no problem...
     
    To clarify, these are IPs that are being statically defined in, and distributed by DHCP from, the UTM on the internal network interface, they shouldn't be being accessed from anywhere without clear routing.
     
    I have 'gateway forwards pings' unchecked and things don't ping (although do once checked.) 
     
    Concerned that I may have done something really stupid i jumped on a host outside the UTM, changed the gateway to the UTMs external WAN IP and tried to ping and access the internal network via HTTP/S - nothing, so the firewall is doing its job and i haven't opened the flood gates somehow i don't think.
     
    So, there is VPN to Internal network routing somewhere, Its interesting even if i've made a mistake in the config that the DNAT doesn't drop the packets, I've checked the SSL VPN IP Pool, user network and group networks in definitions to see if they're being used anywhere untoward, and they're not..
     
    I've combed this UTM of anything obvious and this one is stumping me, any ideas?
     
    I'll run some tests when i get the chance over the weekend too.
     
    Thanks
Reply
  • 0 in reply to BAlfson
    Hi Bob,
     
    Thanks very much and thanks for the comment,
     
    Ok thats interesting, Internet IPv4 is the only network definition in local networks on that SSL VPN profile.
     
    I have full blown HTTP/HTTPS access to the internal network with this VPN profile, i have an ESXi host and a managed switch on the inside among other things and the webpages load up no problem...
     
    To clarify, these are IPs that are being statically defined in, and distributed by DHCP from, the UTM on the internal network interface, they shouldn't be being accessed from anywhere without clear routing.
     
    I have 'gateway forwards pings' unchecked and things don't ping (although do once checked.) 
     
    Concerned that I may have done something really stupid i jumped on a host outside the UTM, changed the gateway to the UTMs external WAN IP and tried to ping and access the internal network via HTTP/S - nothing, so the firewall is doing its job and i haven't opened the flood gates somehow i don't think.
     
    So, there is VPN to Internal network routing somewhere, Its interesting even if i've made a mistake in the config that the DNAT doesn't drop the packets, I've checked the SSL VPN IP Pool, user network and group networks in definitions to see if they're being used anywhere untoward, and they're not..
     
    I've combed this UTM of anything obvious and this one is stumping me, any ideas?
     
    I'll run some tests when i get the chance over the weekend too.
     
    Thanks
Children
  • 0 in reply to P M

    The other "trick" is Web Filtering - I bet you have "VPN Pool (SSL)" in 'Allowed Networks' there.  You might be interested in a document I maintain that I make available to members of the UTM Community, "Configure HTTP Proxy for a Network of Guests."  If you would like me to send you this document, PM me your email address. I also maintain a version auf Deutsch initially translated by fellow member hallowach when he and I did a major revision in 2013.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Hi guys, quick update for anyone following the thread - every remote wanderers worst nightmare, I lost access a day after my last post.. 
     
    This was thankfully due to an ISP change I wasn't aware of, not a mistake on my part (!) but I don't anticipate reconnection for a while (new router means new port forwarding, networking etc to set up and is a low priority on site, i'm not back for a long time) This leaves me without an esxi box to play with or a UTM to troubleshoot..
     
    The original is still an issue for me that I intend to troubleshoot and solve! I will get back to you..
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Unfiltered HTML