Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 39 subscribers
  • Views 2924 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Packet response via Source NAT not working (via SSL-VPN)

intrusus

Hello everyone!

I have the following problem:

I don't want to leave my ESXi server in the WAN, so I created a second VM kernel adapter and assigned an internal IP to the ESXi in addition to the public IP address.

I now want to connect to my network via VPN and manage my ESXi server via this private address. I've put the firewall with a NIC into this "ESXi management network" and created/configured the interface on the admin interface:

At the end I created a VPN firewall rule that should allow me to get access from VPN Zone to the LAN/DMZ Zone (and therefore also ESXi-Network, which is in the LAN Zone).
Here I have to use Source NAT because the ESXi can only have one gateway and this is assigned to its public address.

Unfortunately the XG seems to forward the https request to the ESXi, but I don't get a response because the firewall can't assign the packets:

Here is the VPN rule:

and also the SNAT IP-Host and Policy:

I hope, you can help me out!

Kind regards,
Leon



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi Leon,

    Can you please share your VPN configuration? From the log viewer screenshot, it seems you have SSL Remote VPN configuration. Is Port4 in permitted network in SSL Remote VPN? 

    Thanks,

  • 0 in reply to FormerMember

    Hi H_Patel,

    sure, here you go:

     

    To answer your question, like you can see, I use SSL VPN ;)

    I updated the VPN "Permitted Network Resources" and added "#Port4". Nothing changed, the SF still does not know where to route the https packets back.

    Thank you & kind regards,
    Leon

    Intrusus
    Sophos Certified Engineer | Sophos Certified Technician

    private lab:
    XG firewall with SFOS 20.X running on Proxmox

    If a post solves your question use the 'Verify Answer' link

  • FormerMember
    0 FormerMember in reply to intrusus

    Hi Leon,

    In that case you already have Port4 network in allowed networks. Did you add this Port4 network to the SSL Remote VPN configure recently? Trying to find out if it is in the SSL VPN configuration file on the client side. 

    Thanks,

  • 0 in reply to FormerMember

    Hi H_Patel,

    yeah - i just edited the Permitted Network Resources when you have answered to my first post.

    At Configure > VPN > SSL VPN Remote Access > SSL VPN Profile there were:

    • LAN-172.27.15.0/24
    • DMZ-10.10.10.0/24
    • ESXi-172.27.10.0/24

    I edited it, now there are:

    • LAN-172.27.15.0/24
    • DMZ-10.10.10.0/24
    • ESXi-172.27.10.0/24
    • #Port4

    I also re-downloaded the VPN configuration but no success - the browser still hangs up in the loading of the ESXi https-site, no site builds up.

    Kind regards,
    Leon

    Intrusus
    Sophos Certified Engineer | Sophos Certified Technician

    private lab:
    XG firewall with SFOS 20.X running on Proxmox

    If a post solves your question use the 'Verify Answer' link

  • +1 in reply to intrusus

    ,

    maybe this is kind of interesting for you and the Sophos Firewall Team:

    I have now performed the following steps:

    • Upgrade to v18EAP
    • Created some firewall rules and cleaned it up:
      • The firewall rules are now split up (e.g. LAN to MGMT, VPN to MGMT, etc.) so the naming is standardized, and everything seems more organized.
        Important: The VPN to MGMT rule is linked to a SNAT rule. This rule does nothing else than the SNAT rule from my first post.


    But the error was clearly due to this:
    If in Configure > VPN > Show VPN Settings > SSL VPN Settings TCP is not selected as protocol, but UDP, the XGv17.5 and XGv18EAP discards any https (tcp443) packets back to the VPN user. Ping is working fine using UDP, but any Protocol based on TCP not. After resetting from UDP to TCP, everything works fine!

    That way the problem was solved.

    Cheers,
    Leon

    Intrusus
    Sophos Certified Engineer | Sophos Certified Technician

    private lab:
    XG firewall with SFOS 20.X running on Proxmox

    If a post solves your question use the 'Verify Answer' link

  • FormerMember
    0 FormerMember in reply to intrusus

    Hi intrusus,

    Thank you for updating this post with the solution. Changing protocol to TCP would make more sense as it is connection oriented and that is default protocol used in SSL Remote VPN configuration. I think SNAT did not work well with UDP. 

    Thanks,

     

Reply
  • FormerMember
    0 FormerMember in reply to intrusus

    Hi intrusus,

    Thank you for updating this post with the solution. Changing protocol to TCP would make more sense as it is connection oriented and that is default protocol used in SSL Remote VPN configuration. I think SNAT did not work well with UDP. 

    Thanks,

     

Children
No Data
Unfiltered HTML