Public IP address needed in override hostname?

Hi Frederiek Pascal 

Yes you need to put the public IP of ISP in the override hostname. The NAT device ( ISP router or modem) has to be configured to forward the SSL VPN connection to the XG Firewall.

Override Hostname : This sets the SSL VPN client configuration file to use this public IP when establishing the connection.

Please re download the config file after setting up public IP of ISP and check the SSL VPN status, this will fix the issue.

Hello,

Thanks for your reply.

I changed the hostname override to my public ip 

I re-downloaded the config file and when i try to connect, I still get this error : 

Wed Dec 18 13:20:55 2019 Attempting to establish TCP connection with [AF_INET]84.197.138.2:8443 [nonblock]
Wed Dec 18 13:20:55 2019 MANAGEMENT: >STATE:1576671655,TCP_CONNECT,,,,,,
Wed Dec 18 13:21:05 2019 TCP: connect to [AF_INET]84.197.138.2:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
Wed Dec 18 13:21:10 2019 MANAGEMENT: >STATE:1576671670,TCP_CONNECT,,,,,,

Hi Frederiek Pascal 

I checked port 8443 status on https://ping.eu/port-chk/ and it is showing me closed.

Please confirm if you are also getting  the same status or result if yes then you need to check on that part.

PFA.

sorry for my noob question, but where do i open this port? i thought this was done by following the " How to configure SSL VPN remote access" article.

https://community.sophos.com/kb/en-us/122769 Here it's explained to add a firewall rule too, which i did, but i guess that's not for opening the port? :-)

I mean this firewall rule like described on the KB

I mean this firewall rule like described on the KB

Hi Frederiek Pascal,

You have to forward port 8443 from your ISP device to firewall's WAN interface IP address. By default port 8443 is open on firewall if you have SSL VPN remote VPN configured. 

In your case the firewall is behind ISP modem and has no direct access to the internet so you have to follow that extra step. 

Thanks,

thanks for your answer!

which extra step do you mean?

My configuration is an ISP modem (where the router function is disabled), than my sophos and than my access points for wifi.

still i got this error :

Thu Dec 19 09:10:55 2019 OpenVPN 2.3.8 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Jul 3 2017
Thu Dec 19 09:10:55 2019 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.09
Enter Management Password:
Thu Dec 19 09:10:55 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Dec 19 09:10:55 2019 Need hold release from management interface, waiting...
Thu Dec 19 09:10:56 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Dec 19 09:10:56 2019 MANAGEMENT: CMD 'state on'
Thu Dec 19 09:10:56 2019 MANAGEMENT: CMD 'log all on'
Thu Dec 19 09:10:56 2019 MANAGEMENT: CMD 'hold off'
Thu Dec 19 09:10:56 2019 MANAGEMENT: CMD 'hold release'
Thu Dec 19 09:11:10 2019 MANAGEMENT: CMD 'username "Auth" "xxxxxxx"'
Thu Dec 19 09:11:10 2019 MANAGEMENT: CMD 'password [...]'
Thu Dec 19 09:11:10 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Dec 19 09:11:10 2019 Attempting to establish TCP connection with [AF_INET]84.197.138.2:8443 [nonblock]
Thu Dec 19 09:11:10 2019 MANAGEMENT: >STATE:1576743070,TCP_CONNECT,,,,,,
Thu Dec 19 09:11:20 2019 TCP: connect to [AF_INET]84.197.138.2:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
Thu Dec 19 09:11:25 2019 MANAGEMENT: >STATE:1576743085,TCP_CONNECT,,,,,,
Thu Dec 19 09:11:35 2019 TCP: connect to [AF_INET]84.197.138.2:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
Thu Dec 19 09:11:40 2019 MANAGEMENT: >STATE:1576743100,TCP_CONNECT,,,,,,
Thu Dec 19 09:11:50 2019 TCP: connect to [AF_INET]84.197.138.2:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
Thu Dec 19 09:11:55 2019 MANAGEMENT: >STATE:1576743115,TCP_CONNECT,,,,,,
Thu Dec 19 09:12:05 2019 TCP: connect to [AF_INET]84.197.138.2:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.

anybody? :D 

Is the ip of subnet ok? 

these are my dhcp settings btw 

and the vpn firewall rule is on top

anybody who can help me? :-) 

Hi,

First, is your ISP router in bridge? Are you authentication with XG? If it isn't, then you will need to create a DMZ zone to your XG, or port foward to it, or if Yes then see below.

Your configuration seems fine, just remember to do this before:

1) If there's any need, Allow VPN access to WAN on the Rules.

2) Since It's home usage, use a domain as hostname instead of IP, you can even use Sophos DDNS for this.

3) Change the IPV4 Lease Range for something more sane.

4) In SSL VPN don't forget to put the XG or your DNS server IP in the settings.

5) There's no need to open any port in the Firewall Rules, It open automaticaly when you create a SSL VPN Server.

And at last, the error your getting, "The system tried to join a drive to a directory on a joined drive." Is known in Sophos UTM, some people had lucky changing the SSL VPN port.

Also you can use UDP instead of TCP if you need a bit more throughput.

After you connect to the VPN, don't forget to enable anything that you find necessary for it, such as allow the use of Web Proxy, DNS, or authentication methods in Administration => Device Access.

Thanks,

Hi Frederiek Pascal,

You would have to forward 8443 port from your ISP equipment to WAN interface of the firewall. 

Thanks,

This already done

still not working.... 

I did all what you asked and still it's not working, i got this error : 

Sun Dec 22 13:24:27 2019 OpenVPN 2.3.8 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Jul 3 2017
Sun Dec 22 13:24:27 2019 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.09
Enter Management Password:
Sun Dec 22 13:24:27 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Dec 22 13:24:27 2019 Need hold release from management interface, waiting...
Sun Dec 22 13:24:27 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Dec 22 13:24:27 2019 MANAGEMENT: CMD 'state on'
Sun Dec 22 13:24:27 2019 MANAGEMENT: CMD 'log all on'
Sun Dec 22 13:24:27 2019 MANAGEMENT: CMD 'hold off'
Sun Dec 22 13:24:27 2019 MANAGEMENT: CMD 'hold release'
Sun Dec 22 13:24:43 2019 MANAGEMENT: CMD 'username "Auth" "frederiekpascal"'
Sun Dec 22 13:24:43 2019 MANAGEMENT: CMD 'password [...]'
Sun Dec 22 13:24:43 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Dec 22 13:24:43 2019 MANAGEMENT: >STATE:1577017483,RESOLVE,,,,,,
Sun Dec 22 13:24:43 2019 Attempting to establish TCP connection with [AF_INET]84.197.138.2:8443 [nonblock]
Sun Dec 22 13:24:43 2019 MANAGEMENT: >STATE:1577017483,TCP_CONNECT,,,,,,
Sun Dec 22 13:24:53 2019 TCP: connect to [AF_INET]84.197.138.2:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
Sun Dec 22 13:24:58 2019 MANAGEMENT: >STATE:1577017498,RESOLVE,,,,,,
Sun Dec 22 13:24:58 2019 MANAGEMENT: >STATE:1577017498,TCP_CONNECT,,,,,,

I do have a question about something which is not clear for me.

In the KB they mention this : 

Defining local subnet and remote SSL VPN range

Go to Hosts and Services > IP Host and define the local subnet behind Sophos Firewall.

My question, the subnet you have to define, is that the current subnet you are using on your network? 

I mean my ip is 192.168.0.66 at this moment, so the subnet is have to add in this section is 192.168.0.0? 

If you search on this forum, you will see 5 posts with the same problem as you, " failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive. ".

Most of them fixed by changing the SSL VPN port to something else.

Frederiek Pascal said:

Sun Dec 22 13:24:53 2019 TCP: connect to [AF_INET]84.197.138.2:8443

On your connection still 8443, change it to something else.

From the posts here in the forum, 4 of them fixed this by changing the SSL VPN port.

You will also found some people with the same error on the OpenVPN forums, most of them had this error because there has another service running on the same port, I don't know why this would happen on XG.

Frederiek Pascal said:

My question, the subnet you have to define, is that the current subnet you are using on your network? 

Yes, It's correct, you need to define the subnet your current using on your LAN, and another one for SSLVPN.