Port Forwarding on Sophos Xg86

Abraham,

screenshots provided are too small. Can you provide screenshots that are readable?

Also, what issue, do you have?

Thanks

Hello Iferrara

i deployed my xg 86 in bridge mode , i bridge port 1 lan and port 2 wan  , with ip 192.168.1.2

i have a cisco router 2901 connected to isp. the cisco router is the dhcp server for the network , i did port forwarding on the cisco router to internal server 192.168.1.3 , listening port is 90 , internal port is 4930 and is working . BUT when i deployed sophos xg 86 , access to internal server not working again this is my problem

Access to internet is ok 

Hello Iferrara

i deployed my xg 86 in bridge mode , i bridge port 1 lan and port 2 wan  , with ip 192.168.1.2

i have a cisco router 2901 connected to isp. the cisco router is the dhcp server for the network , i did port forwarding on the cisco router to internal server 192.168.1.3 , listening port is 90 , internal port is 4930 and is working . BUT when i deployed sophos xg 86 , access to internal server not working again this is my problem

Access to internet is ok 

Thanks for the screenshot.

If the Cisco translates already the port from 90 to 4930, on the DNAT rule, you need to use 4930 and not 90 as service and destination port.

If the Cisco does not perform translation, you need to use first the port 90 and under mapped port the 4930.

If it does not work, use the live logs to understand what is blocked.

Regards

Ok, 

pls do i need to check or enable following rule 

No for all of them.

Follow this kb:

https://community.sophos.com/kb/en-us/122976

pls Iferrara,  i did all that but it did not work 

In my case what will be the Destination host/network Ip addrerss  , is one of my  public ip , or my  router Public IP outside  or the bridge IP or choose ANY

what have here my public ip .11 and my public ip for the DNAT on router is .12 because i have /29 , that is 6 useable public ip address  

Check the firewall logs under the log viewer.

Abram,

Since you are using bridge mode, you do not need dnat but just a network rule from wan to lan with the services you want to allow. My mistake!

thank you so much Iferrara, that solved scenario

I appreciate you.

I need to block some adult web site because am deploying this Sophos xg68 for a primary and secondary school. what are the likely sites i need to block and how ??

Abramsu,

You should open a separate thread. One question per thread.

Thanks

Hello lferrara,

I also have the same problem, I have cisco router and sophos XG 115W firewall, my firewall is at the middle of my router and switch.

The firewall is configured in Bridge mode. so i followed your instruction above and created a rule form Wan to Lan as shown in the screenshots below but it's still not forwarding traffic.

Please advise.