Port forwarding not working as expected

Hi mayberts 

Thank you for providing the screenshot,

In the configuration, you have mapped port 28015 to 28016 which means someone trying to access port 28015 from external will be mapped to 28016.

Please refer to the article -https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/DNATFNATLBRule.html

Hi Keyur 

Many thanks for responding and providing the link.

If you look at the service I created it will forward 1:65535 to 28015:28016.  anything on the WAN zone port 1:65535 will be forwarded to the protected using either UDP ports 28015 and 28016.

I can't change the "mapped port" section in the forward to section. 

thanks

Hi mayberts 

Please verify that ports you wish to access is locally reachable from the firewall, you can try to ping or telnet the ports from firewall console, please try packet capture - https://community.sophos.com/kb/en-us/123189

Telnet from sophos console connection timed out on port 28015

Hi mayberts 

It means, that port is not opened in the device its self, please verify the same.

This is odd

so the following ports are open on the device (windows 10) but I can only telnet to port 25565

25565

28015

20816

Hi mayberts 

I understand your concern but I am may not be able to help you at OS level but you may verify if anti-virus or OS firewall is blocking.

I have ruled out this being an OS level issue.  I have created another DNAT and I am getting the same results.  Out of the 3 DNAT rule only one is working.

Hi mayberts 

Please try packet capture utility - https://community.sophos.com/kb/en-us/123189 and try to capture packet on the port which is not accessible to narrow down the issue further.

so port 28018 is the port in question. 

Hi mayberts 

As per the capture, traffic is being forwarded using rule number 12 but there is no reply packet from the destination system.

Hi mayberts 

Why do you have MASQ enabled on your DNAT rule?

Please remove this and try again.  Also please ensure that its UDP that you would like.

Try changing the destination port to a single port and duplicate the rule for the second port.

Let us know how that goes.

Thanks!

Hi mayberts 

Why do you have MASQ enabled on your DNAT rule?

Please remove this and try again.  Also please ensure that its UDP that you would like.

Try changing the destination port to a single port and duplicate the rule for the second port.

Let us know how that goes.

Thanks!