This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Dnat port issue - from external network - Sophos XG

Hi,

I am trying to allow external access to an internal Server on our network.

Appliance used is a Sophos XG430 and it sits behind a router in it's own DMZ

Here are the settings used:

Source Zones: WAN
Allowed Client Networks: Any
Destination Host/Network: WAN Interface - 192.168.100.254
Services: Custom Service with Source port 7999 : Destination Port 25000
Protected Servers: Custom_Name_Server_IP - 10.10.10.10
Mapped Port: 25000 (auto configured from the above custom service)
Protected Zone: LAN

I want to mention that the EXACT same settings worked just fine with the previous setup on a Sophos SG series appliance.

Any help would be greatly appreciated.

Thanks in advance.

This thread was automatically locked due to age.

Parents

0 lferrara over 4 years ago

Marius,

make sure that DNAT on all port is opened on the router to the XG wan interface. For the XG rule, please share the firewall rule.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Marius Tarau over 4 years ago in reply to lferrara

Thanks, I managed to make it work for now, I had to enter 1:65535 as the source port.

But what I am actually trying to do is:

Have the Sophos appliance listen for traffic on a specific port (1111 for example) and redirect to Host A on port 2000 for example. Another rule would be to listen for traffic on another port (2222 for example) and redirect to Host B on the same port 2000.

Can this work?
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago in reply to Marius Tarau

Yes, this will work but not the other way around.
Cancel
Vote Up 0 Vote Down

Cancel
0 Marius Tarau over 4 years ago in reply to lferrara

It works as I said before only if I enter 1:65535 as a source port, if I enter a specific port there it stops working, here's the example that doesn't work:
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago in reply to Marius Tarau

Marius,

under source port you shall leave * or 65535. Under the service, leave the external port as 1111 and 2222 for both 2 firewall rules.

Regards
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 lferrara over 4 years ago in reply to Marius Tarau

Marius,

under source port you shall leave * or 65535. Under the service, leave the external port as 1111 and 2222 for both 2 firewall rules.

Regards
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data