Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 2 answers
  • Subscribers 5 subscribers
  • Views 4809 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Internet pass-through from DMZ to external Wireless Router

Phil White

Hello,

 

First off, I've found this forum an extremely useful resource and mostly managed to find the info I need by searching, alas I can't seem to find the answer to the following.

 

I use an SG115 with the Sophos UTM home license, along with an AP55c AP.  So far I've been fine with the 50 IP limit.  Now, with all my smart plugs etc I'm starting to regularly skirt the 55 IP limit.

 

I'd like to move all my IoT devices onto a segregated network so that they don't count against the IP limit.  They only need internet access and obviously no access back into the internal network, or each other.  I have a Mikrotik wireless router lying around unused so I'd like to use that for this purpose.

 

My theory is that I can use the DMZ port on the SG to pass-through  the Internet connection to the miktrotik, where I can set the wireless rules.  I 'think' I need to do the following, can someone please tell me if I'm way off base here?  thanks in advance:

 

1- Create the DMZ Interface on the UTM, Eth2 (DMZ) and give it an IP e.g. 192.168.88.2

2- Create a Masq rule as follows - Network - Any, Interface DMZ

3 - Firewall Rule - Source - Any, Services - Web Surfing, Destinations - DMZ, ALLOW

 

Then on the Microtik side, the Router IP is 192.168.88.1, set WAN address to 192.168.88.2

will this work?

 

Thanks in advance

-Phil

 



This thread was automatically locked due to age.
Parents
  • 0

    Hi again,

    I would like to stop traffic from the IoT network (Mikrotik) accessing the lan on my sophos. The devices attached only need to access the Internet, nothing else.

    Any suggestions on how best to achieve that? The Mikrotik has a fixed IP of 192.168.1.100 and I’ve tried to create a fw rule to block it from accessing the lan but that didn’t seem to work  (source Mikrotik wan 192.168.1.100 —- service any ——- destination  lan (network))

    Thanks in advance

Reply
  • 0

    Hi again,

    I would like to stop traffic from the IoT network (Mikrotik) accessing the lan on my sophos. The devices attached only need to access the Internet, nothing else.

    Any suggestions on how best to achieve that? The Mikrotik has a fixed IP of 192.168.1.100 and I’ve tried to create a fw rule to block it from accessing the lan but that didn’t seem to work  (source Mikrotik wan 192.168.1.100 —- service any ——- destination  lan (network))

    Thanks in advance

Children
  • 0 in reply to Phil White

    Hmmm, are the other Mikrotik-related firewall rules before or after the one you just described?

    Most likely, #2 in Rulz has your answer.  You weren't specific about the traffic that's getting through, but I suspect the 'ICMP' tab and Web Filtering in Transparent mode.

    You might be interested in a document I maintain that I make available to members of the UTM Community, "Configure HTTP Proxy for a Network of Guests."  If you would like me to send you this document, PM me your email address. For our German-speaking members, I also maintain a version auf Deutsch initially translated by fellow member hallowach when he and I did a major revision in 2013.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML