Customized port forwarding doesn't work

Question

Hi, my name is Kevin, I have installed the last version of Sophos XG (SFOS 17.0.6 MR-6) and port forwarding doesn't work. I have configured a customized port forwading form 667 WAN port to 443 LAN port but don't work. I have follow DNAT/Full NAT/Load Balancing online tutorial https://community.sophos.com/kb/en-us/122976#what%20to%20do 
 but the connection is refused. 
 If I delete a customized service but inset a general HTTPS service (with all port open 1:65535 ) work, but I don't want open all port but o nly those I need. 
 Where is the error? 
 
 Thanks a lot

Fabien Martinet · Answer

Hi, 
 
 you need to use 1:65535 as origine port, and your port as destination when creating the service. 
 In fact you d'ont need to create a specific service. 
 Then is the DNAT rule you can indicate the accessed port and destination port. 
 Destinazione & servizio : wan ethernet port (port 2 from your example), port 667 
 Server protetto : nas principale port 443

Aditya Patel · Answer

Hi dominusdj , 
 
 It would seem you may need to retrace the traffic flow. The rule that you have configured is correct i.e. The source port of the traffic is 667: TCP and destination port 443:tcp. 
 If the traffic came from a different source the traffic will not be forwarded. 
 Simply check on the console via SSH. 
 command > tcpdump 'port 443 and host <Traffic initiated WAN address> 
 If the source port is exactly the same then it will be forwarded. 
 Under Normal circumstances the Source Port is variable

Aditya Patel · Answer

Hi dominusdj , 
 Based on the traffic the Source port is 48505 for the first transition and 52431 for another transition. As this would change to each time a new session is connecting/established. 
 If you wish to deny access your HTTPS connection to your internal server we have options to add Allowed Host which would help you configure them accordingly. 
 In other words, due to the nature of the traffic, the Source Port cannot be set which would specifically fall under the service you have configured. So the configuration for source port would be * or 1:65535 and destination port would be 443 TCP.

Aditya Patel · Answer

Hi dominusdj , 
 
 If that is the scenario that you wish to have a customized port then you may try this option 
 
 https: \ xyz.com:666 > WAN > LAN > Server https: \192.168.3.2:443 
 
 For this, you may create a Custom Service 
 TCP > Source 1:65535 Destination: 666 
 
 Create a Firewall rule DNAT/FullNAT/load balancing 
 Source WAN , Allowed Client Networks (Specify or ANY ) Blocked Client Networks(If any). 
 Destination Host Network > LAN PORT connected to Server 
 Service > Custom Service 
 Forward to Protected Servers > Specify the IP address of the server i.e 192.168.3.2 
 Enable Change Destination Ports to TCP:443 
 Protected ZOne <Server / interface ZOne> 
 
 Apply IPS (Recommended) 
 Routing 
 Rewrite source address (Masquerading) 
 
 Save. 
 Let me know if that is what you are looking for...

Aditya Patel · Answer

Hi dominusdj , 
 It is usually is a formality to allow Source Port 1:65535 as explained earlier. The packet contains 4 elements which need to be considered. 
 1. Source Address 2. Source Port 3. Destination Address 4. Destination port. 
 3 is known to a user i.e 1,3 & 4. The Source port use Ephemeral port which a range of Private ports and is random in nature and is determined by the Operating system. You can change the range if you wish but that is a system based configuration which is not recommended. 
 We have provided this option to allow the user to set the range needed. 
 As for IPS, the policy is used to prevent attacks from an unknown as it is signature-based detection.