DNAT Problems on MR-5

Can you show screenshots of both? 

I have the strong feeling, your Service is causing this issue. Double check the service, if it actually match. 

Hi David Moro,

Would it be possible for you to run a packet capture on the destination IP address from the Diagnostics > Packet Capture and share a screenshot with us?

• Monitor traffic using Packet Capture Utility in the Sophos XG Firewall GUI

Thanks,

Hi,

shouldn't the destination in the NAT be a network not an xg interface (one IP address)?

ian

Thats perfectly fine. The DNAT will hit the WAN IP, you want to translate to a IP behind XG. 

Yes.... but if i try to reach the exposed service it'll not work

Also with network don't work :D

Red= Firewall public ip..... Black= public ip that is trying to reach the exposed service

10.1.1.10 = internal server ip natted externally

Assuming matching NAT ID: 1 and firewall rule ID: 2 are correct.

As per the packet flow, the traffic is being forwarded to internal server 10.1.1.10 for destination port 8080, but there’s no reply coming back.

I'd suggest try applying SNAT as the default MASQ and check whether the server is accessible publicly or not.

This is the default MASQ for all hosts

This is the default MASQ for all hosts

Please apply SNAT as MASQ in NAT rule ID:1 (DNAT rule configured for 10.1.1.10).

With MASQ it works fine... why does it need MASQ in SNAT?

If you apply SNAT as MASQ, then the source IP in the incoming request will be translated with an outgoing interface IP address. As per your environment, the source IP will be translated to Port1 interface IP.

With SNAT as original, Sophos Firewall forwards the original source IP address(public IP of client) to the translated destination(10.1.1.10).

As I mentioned earlier, traffic was getting forwarded by Sophos Firewall to the destination server 10.1.1.10, but there was no reply coming back.

Further, you can run a packet capture on 10.1.1.10 server and check whether it responds to requests coming with public IP or not.

Maybe the system you NAT to has no default gateway configured and so the traffic to requesting WAN client is not routed back. Stumbled over that a few times.