Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL remote user VPN - home subnet conflicts with work subnet

I am in the process of switching over a number of sites from cyberoam to sophos xg106 latest firmware.

On cyberoam, if the work network had the same subnet as the remote user's home network, I was able to setup an alias or forwarder or virtual host subnet so the remote home worker could still access resource on the work network.

For example if work subnet is 192.168.1.x and home subnet is 192.168.1.x  then home user can't ping or use remote desktop to access their work pc.

if you try to reach 192.168.1.abc it will only search the home network.

What i've done in the past is setup an translation subnet like 192.168.81.x 

If the user try's rdp to 192.168.81.x the firewall will translate it to 192.168.1.x

how can this be done with the sophos?



This thread was automatically locked due to age.
Parents
  • Hello there,

    Thank you for contacting the Sophos Community.

    It would be better for you to move away from the subnet 192.168.x.x on the business side, that range isn’t recommended to use.

    However in this case, you could configure in the SSL VPN a Fake IP such as 172.16.123.0/24 so this is passed down to the clients when they connect to the SSL VPN.

    Then create a DNAT rule that looks like the following, this is to access only one Server in this case 172.16.15.100, in your case you would put the IP of your server. (e.g 192.168.1.100)

    Then the user will just have to enter on their PC 172.16.123.100 to access the server using 192.168.123.100

    Regards,


     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support VideosProduct Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • The home network PC already creates a route to its local firewall (home router) in the 192.168.0.x range to connect to the internet. Then the SSL adapter created another route from 172.16.x.x to the XG gateway. Since a route already exists to 192.168.0.x it will not ping or connect to the pc in the office network. I have tried to do this and wasn't able to. So i have advised the home users to change their range to 192.168.20.x or in the 10.xx range. Its kind of frustrating but would welcome any suggestions that would be an easy fix on the XG side. 

  • I think Emmanual is saying you would ping 172.16.15.xzy and the dnat rule would transfer/translate it to 192.168.20.xyz on the work network. in theory..

Reply Children
No Data