This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issues while creating a hairpin NAT

Hi folks,

another post on my issues about creating a firewall hairpin nat rule.

I have an NTP server on my network and I want devices to use it as a reference time source. I know the device works when I change network devices to query it for time, they update correctly.

When I built my own firewall rule using a linked NAT rule there was lots of queries to the rule but nothing was returned.

So, I have decided to use the XG build a server access rule.

I think one of the questions in the create wizard is wrong

It asks for the external source networks and devices, but never asks for the internal networks. You can add your internal networks which I did.

Next issue is the reflexive rule automatically created does not use the required service as entered in previous pages, just uses ANY which allows all traffic to bypass the specific NAT and linked NAT rules. Again you can change it to the required service.

Next issue is the created firewall rule appears to be wrong.

Destination zone is LAN but the destination network is the external interface which is a WAN zone.

The result is the rule does not work.

I have tried creating a FQDN for the external internal access to the NTP, but there is nowhere to add it to the rule along with a number of other issues of trying to add another external url for the same address, the XG does not like it.

Please advise what is required to make the hairpin NAT work. I have read the KBA and followed that document and ended up with the above issues.

Ian

.



This thread was automatically locked due to age.
Parents
  • Hello rfcat_vk,

    Thank you for contacting the Sophos Community!

    Can you do a packet capture on the GUI, to see if the traffic is arriving and then what rule is being processed?

    As per the Firewall rule, I used the Wizard and got the correct WAN to WAN.

    Regards,


     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support VideosProduct Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • Hi EmmoSophos.

    None of the internal devices hit the firewall rules. Logviewer only shows the NTP server using the IPv6 rule allowing it out and one dumb device that breaks the country rules when it can't connect to the NTP server.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Looking at the traffic coming from the internet I see the same issue when I build my own rules, the firewall does not appear to know what to do with the traffic, there are no returned packets from the NTP server.

    Ian

    • messageid="00001"
    • log_type="Firewall"
    • log_component="Firewall Rule"
    • log_subtype="Allowed"
    • status="Allow"
    • con_duration="41"
    • fw_rule_id="39"
    • nat_rule_id="7"
    • policy_type="1"
    • user="housemate"
    • user_group="IoT"
    • web_policy_id="0"
    • ips_policy_id="11"
    • appfilter_policy_id="1"
    • app_name=""
    • app_risk="0"
    • app_technology=""
    • app_category=""
    • vlan_id=""
    • ether_type="Unknown (0x0000)"
    • bridge_name=""
    • bridge_display_name=""
    • in_interface="Port1"
    • in_display_interface="IoT LAN"
    • out_interface="Port4"
    • out_display_interface="BIGPOND WAN"
    • src_mac="84:F3:EB:2D:C1:AB"
    • dst_mac="A0:36:9F:6C:96:E8"
    • src_ip="192.168.3.8"
    • src_country=""
    • dst_ip="128.9.176.30"
    • dst_country="USA"
    • protocol="UDP"
    • src_port="5000"
    • dst_port="123"
    • packets_sent="4"
    • packets_received="0"
    • bytes_sent="304"
    • bytes_received="0"
    • src_trans_ip="10.10.10.5"
    • src_trans_port="0"
    • dst_trans_ip=""
    • dst_trans_port="0"
    • src_zone_type="LAN"
    • src_zone="LAN"
    • dst_zone_type="WAN"
    • dst_zone="WAN"
    • con_direction=""
    • con_event="Stop"
    • con_id="1434291968"
    • virt_con_id=""
    • hb_status="No Heartbeat"
    • message=""
    • appresolvedby="Signature"
    • app_is_cloud="0"

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • I might have fixed my issue, but not using a hairpin created with the wizard, but my own firewall rule. I changed the NAT 

    to use the override -> the internal network with the server on it and the internal server.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Hi,

    Have just tried the same, but no luck, in this test I want to get my Plex server accessed from the XG's public WAN IP:

    Routing preceedence is statis route first.

    And the Loopback from the DNAT assistant, does not work either...

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

  • messageid="02002" log_type="Firewall" log_component="Appliance Access" log_subtype="Denied" status="Deny" con_duration="0" fw_rule_id="N/A" nat_rule_id="0" policy_type="0" user="" user_group="" web_policy_id="0" ips_policy_id="0" appfilter_policy_id="0" app_name="" app_risk="0" app_technology="" app_category="" vlan_id="" ether_type="IPv4 (0x0800)" bridge_name="" bridge_display_name="" in_interface="PortE2" in_display_interface="LAN" out_interface="" out_display_interface="" src_mac="xxxxxxxx" dst_mac="" src_ip="192.168.x.x" src_country="" dst_ip="WAN IP" dst_country="DNK" protocol="TCP" src_port="64563" dst_port="32400" packets_sent="0" packets_received="0" bytes_sent="0" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="" src_zone="" dst_zone_type="" dst_zone="" con_direction="" con_id="" virt_con_id="" hb_status="No Heartbeat" message="" appresolvedby="Signature" app_is_cloud="0"

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

  • I found with the DNAT wizard I could setup access to the server from the internet but the server did not respond.

    Also I found that the translated details do not appear in the logviewer until you way the mouse over the lefthand side symbol and it shows whether translated and packets sent and received.

    I will try again the with DNAT wizard.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • You beat me to the post. That is not translating. I will see what I can test.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Same here, thanks, no post hijacking intended Stuck out tongue winking eye

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

  • Hi Martin,

    a total failure. In my limited understanding of NAT the firewall rule appears to be wrong. 

    You want a LAN to WAN rule for the server, then you want the external access then you need the internal people to access it via the external interface and that is not what I am seeing in the DNAT wizard setup.

    My testing is limited at the moment because I deleted the Dyndns entry for my NTP server so there was no incoming traffic. I need to re-create it and start testing again but building my own NAT rules.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • Hi Martin,

    a total failure. In my limited understanding of NAT the firewall rule appears to be wrong. 

    You want a LAN to WAN rule for the server, then you want the external access then you need the internal people to access it via the external interface and that is not what I am seeing in the DNAT wizard setup.

    My testing is limited at the moment because I deleted the Dyndns entry for my NTP server so there was no incoming traffic. I need to re-create it and start testing again but building my own NAT rules.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

Children
  • Hi,

    Was just on with support, we did create new DNAT rule with the assistant, this assistance crated:

    - FW rule

    - DNAT

    - Reflex NAT

    - Loopback NAT

    As we have seen every time, but what he did, was to edit the newly created firewall rule, and add the zone (Only WAN was there in the bginning) where FROM you ALSO want to access the traffic, in my case LAN, as the server was also on the LAN in my lab:

    And then it worked!!

    can you try?

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

  • tricky, undocumented feature.

    Will do later tonight depending on my wife and my exclusive use of the XG.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Yup - no need for a auto created loopback rule, when it's not working :-)

    Better leave the XG behind......

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

  • So far absolutely useless, no traffic at all. Like you my server is only LAN.

    Not only that. the addition made no changes to the NAT rules.

    So in summary a major fail.

    Ian

    I am seeing UDP flood due to the firewall rule failure.

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • So I tested in production today, nothing worked. BUT if I setup a webserver on my laptop, create the rules, everything works.

    When I then create the same rule, but point to the org webserver (We where on DMZ both of us), nothing works, except traffic from outside can pass, but loopback broken and log floating with:

    messageid="00005" log_type="Firewall" log_component="ICMP ERROR MESSAGE" log_subtype="Allowed" status="Allow" con_duration="0" fw_rule_id="12" nat_rule_id="9" policy_type="1" user="" user_group="" web_policy_id="0" ips_policy_id="0" appfilter_policy_id="0" app_name="" app_risk="0" app_technology="" app_category="" vlan_id="" ether_type="IPv4 (0x0800)" bridge_name="" bridge_display_name="" in_interface="PortE2" in_display_interface="DMZ" out_interface="" out_display_interface="" src_mac="xx:xx:xx:xx:xx:xx" dst_mac="" src_ip="x.x.x.x" src_country="" dst_ip="wanip" dst_country="DNK" protocol="ICMP" icmp_type="12731" icmp_code="443" packets_sent="0" packets_received="0" bytes_sent="0" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="DMZ" src_zone="DMZ" dst_zone_type="" dst_zone="" con_direction="" con_event="Interim" con_id="1083932784" virt_con_id="" hb_status="No Heartbeat" message="" appresolvedby="Signature" app_is_cloud="0"

    Sophos XG Firewall: How the ICMP error messages works and how to allow or deny it

    Have read this, but the code provided does not make sense, have opened a supportcase again :-O

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

  • I gave up, hairpin NAT internal to internal does not work from what I can see in the logs.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Got it working, but it's very complex I think.

    The dnat assistant cannot solve this.

    Regaring NTP service see this workaround:

     Sophos XG: XG as NTP server – workaround – martinsblog.dk

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

  • Hi Martin,

    thank you for the link. The fix assumes you can change the various network device’s ntp server setting, what I am trying to achieve involves redirecting ntp requests to the internal ntp server.

    I am tying to workout some logical way of achieving this, but so far XG fails.

    ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Did this, its easy but you have to follow certain points: 

    Create a NAT Rule with:

    Source: Your internal Network
    Translated Source: MASQ 

    Destination: ANY
    Translated Destination: Your Internal Server

    Service: NTP

    Firewall:
    Source: All Zones, you selected in NAT
    Destination Zone: (Try first ANY to Test it, after successful tests, change it to your specifics, like WAN Zone or internal Zones etc.). 
    Service: NTP 

    This should cover all the traffic and redirect it to the NTP Server in a transparent manner. 

    You need a firewall rule + NAT Rule, created by your own. 

    __________________________________________________________________________________________________________________

  • Hi Lucar,

    there is a flaw with that setup, the ntp server will never update, just loop on itself. The Nat rule needs to be linked and that is where I failed last time. Iwill try again.

    ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.