Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 3147 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Host to route Internet traffic through VPN (UTM8<->UTM9)

Ray Jimenez

I have read other posts related to this and have tried what seems appropriate in my particular scenario.  Below is what I have now.  I believe that my problem may be related to the fact that I am using UTM9 on one site and UTM 8 on the other. Any help would be appreciated.

Site A: 172.16.31.0/24 behind UTM 8.316

Site B: 192.168.69.0/24 behind UTM 9.405-5

Client on A: 172.16.31.94

I would like to have Internet traffic from Client A to go down VPN between site A and site B and go out the WAN port on site B.  Basically, when I go to http://checkip.dyndns.org the reported IP address should be the IP address of Site B.

I have a VPN between A and B so that all machines in A can get to machines in B and vice-versa.  That's all set and has been working that way for a long time.

SITE A:

'Remote Networks' = 192.168.69.0/24,

'Local Networks' = 172.16.31.0/24,

Automatic Firewall Rules OFF,

Strict Routing ON

SITE B:

'Remote Networks' = 172.16.31.0/24.

'Local Networks' = 192.168.69.0/24,

Automatic Firewall Rules OFF,

Strict Routing ON

 

 

To route traffic for Client on A, I created a separate VPN from Site A to Site B that only includes the IP for the client on A. When I enable this VPN, the Client machine 172.16.31.94 cannot get anything on 192.168.69.0/24 nor can it get to anything on the internet. All other machines on Site A and Site B continue to communicate bidirectionally.

SITE A:

'Remote Networks' = Internet IPv4.

'Local Networks' = 172.16.31.94,

Automatic Firewall Rules OFF,

Strict Routing ON

SITE B:

'Remote Networks' = 172.16.31.94.

'Local Networks' = Internet IPv4,

Automatic Firewall Rules OFF,

Strict Routing ON



This thread was automatically locked due to age.
Parents
  • 0

    You will need the Internet IPv4 in your local and remote networks as indicated in your second example. Since in this example IPv4 is the only network being in the tunnel, it's clear that your client cannot reach anything on the remote network.

    For internet to work I think you must also create a Masquerading rule on site B to masquerade the 172.16.31.0/24 net to your public IP just like you have for your internal network.

    Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

    Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.

Reply
  • 0

    You will need the Internet IPv4 in your local and remote networks as indicated in your second example. Since in this example IPv4 is the only network being in the tunnel, it's clear that your client cannot reach anything on the remote network.

    For internet to work I think you must also create a Masquerading rule on site B to masquerade the 172.16.31.0/24 net to your public IP just like you have for your internal network.

    Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

    Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.

Children
No Data
Unfiltered HTML