Configuring VPN Remote Access for the first time on your Sophos XG Firewall? Check out this useful Community post!
We'd love to hear about it! Click here to go to the product suggestion community
I am trying to publish multiple services to the Internet. It is working fine using business rules. But, I want to be able to add a loopback/hairpin NAT so that if someone inside the network uses the public IP to access the service they are redirected to the internal network. I would also like this bound to an interface IP and not an IP object because it will not always be a static IP.
In reply to Big Ray:
In reply to JasonKnott:
In reply to ArunGupta:
Ok, I made some tests and found definitive answer.
Yes it is possible. How to do that. Just create a Business Rule for non-HTTP Policy and specify as follows:
Exceptions: none defined
Section: Hosted Server
Source Zone: Any
Hosted Address: #Port2-a.b.c.d
Section: Protected Application Server(s)
Protected Zone: LAN (or DMZ)
Protected Application Server(s): YourServerHost
Forward all ports: no (off)
Section: Port Forwarding
Rewrite source address (Masquerading): Yes (On)
Use Outbound Address: MASQ (or any NAT policy if you have more than one public IP address)
Other sections: as required.
The MOST important is "Hosted Server" section. You MUST select "Any" zone because it defines interface which the traffic will come from (as I understand it). You must also select hosted address from firewall supplied #Port2 (or any other WAN port you use) because this is your public IP.
If you select Source Zone as WAN you will limit originating connection to come from any interface marked as WAN and automatically disable access to that rule from LAN side.
I have tested this on IMAP and SSH published to the Internet. When I was connecting from LAN side using external public address, the server reported connection from the XG IP not my LAN workstation IP.
In reply to Slawski:
Actually the Source Zone could be LAN which works and makes more sense.
In reply to ShaunLovatt:
It depends on you ruleset. If you want to use the same rule from WAN and LAN, LAN alone does not work.
This is a pretty good answer and a step in the right direction, but by following your steps, all traffic that appears at the destination host will have a source IP of the firewall, which is pretty dangerous for logging and control.
What you could do instead is to create 2 rules. A standard WAN->LAN DNAT Business Application rule (NO MASQ), and the same again, using the source zone as LAN (WITH MASQ).
This is obviously still not perfect, as the LAN traffic will show up on the destination host as the firewall, but this is arguably a lot safer than all of the WAN traffic, as well.
In reply to Josh Leisk:
That was my final solution until my server went to cloud ;) Haven't updated the thread though.
Awesome, this just help me resolve my issue today.