Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 43 subscribers
  • Views 7564 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Bridged mode ---> Passing trough VPN ?

Gioser

Hello 

I have an Ubiquiti Security Gateway router,  it has VPN lpt2 ipsec server letting the clients to access internal resources.

Of course I can connecto to the VPN, since the Ubiquity is handling that , but the XG105 (SFOS 17.5.0 GA)  in bridged mode is bloking the access to all the internal resources, 

The Firewall rules should not block anything, NAT is just doing MASQ.

All is in default from the Bridged mode initial setup. I just want to use IPS and AV.  

 

Any advice will be great !!

Thank you 



This thread was automatically locked due to age.
  • 0

    Can you show us the Bridge and the other Interfaces? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Hello 

    This is the Bridge Interface, have onother one for WifiGuest autogenerated but it is disabled. (Disabled DHCP for this too)

    Tried unchecking "Enable routing on this bridge pair"  but it is the same.

    Thank you !

  • 0 in reply to Gioser

    You need in Bridge scenario a LAN to LAN Firewall Rule. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    BTW I'm only using Port 1 and Port 2. (the other 2 ports are not connected)

    I will try find more infromation about how to configure it that way, thank you.

  • 0 in reply to Gioser

    Hello 

    I've updated the Bridge now looks like this:

    Only one WAN and one LAN  (ROUTER (with VPN)---> XG 105 --> FIRST SWITCH).

    For full transparent bridge  mode should I use 2 LANS and 1 WAN ?  one for accessing the UI, and another one withiouth IP ?

    Still not sure why i need a lan to lan rule, if only have one lan? I thought that lan to lan was used to connect 2 lan interfaces.

    Still having issues while connected to internal resources, while using VPn.

    Maybe using the XG 105 as a full transparent BRIDGE (like a switch) it could help?  I still would be able to use IPS and AV ?

    Any help will be great, thank you.

     

     

  • 0 in reply to Gioser

    Solved created a firewall rule Wan to Lan any any... Accept, fully open. And the vpn worked again.  

    Not a big deal since it is already behind another fw, going to start to closing and adding filters,

     we were having issues with dhcp any strange ip was assigned to the TV today....I will investigate that.

    and whatsapp was not working, till disabled  the filters, app filter was interfering. More things to investigate.

    As well Chrome was reporting ssl certificates issued by the xg 105 were not valid..... I imagine xg 105 opens the ssl analyze and add its own ssl, but how do I know if the real ssl, home banking for example have problems if it is obscured by the xg 105 new ssl cert?  The risk is higher maybe than having a virus.

    Still a long trip to go, but in the path at least....

    Thank you

  • 0 in reply to Gioser

    Hi Gioser,

     

    We've been having the exact same problem, except we VPN connect to Cisco ASA and not the Ubiquiti Security Gateway you're using. May you PM me a screenshot of your firewall rule setup? Any other insight you have since you've created the "WAN to LAN , ANY to ANY" rule would be much appreciated as well. We're only using Sophos XG to filter web and email traffic.

  • 0 in reply to AZNatives

    Hi AZNatives

    Are you using exact same scenario - XG in bridge mode.

    I am trying to implement email protection but...without any success. Could you please share your config(or at least partial)?

    A client of our is using edge MKtik router and I am going to implement XG310(Inet--router--Sophos--internal net(

    Sophos is in bridge mode(LAN,WAN) with 1 IP in internal network.

     

    It would be great if you share some info.

     

    Also clients mail server is external ;)

    SO ext. mail server+bridge mode+email protect+VPN. SO FUN!!

     

    Thank you in advance guys!

  • 0

    The setup documentation implies that bridged mode is completely transparent,  in the same way the Cyberoams were but it isn't true.  As stated above you do need to manually enter a firewall rule allowing all traffic from WAN to LAN.  Because in bridged/transparent mode the Sophos device is behind your regular firewall, this shouldn't cause any issues but does allow any rules you have in your own firewall for WAN access to the LAN to then work.

  • 0 in reply to nathanwoodcock

    Bridge mode will simply build a Interface Bridge on XG. 

    Therefore you need still a firewall to allow the traffic. 

    __________________________________________________________________________________________________________________

Unfiltered HTML