Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 17 replies
  • Answers 1 answer
  • Subscribers 43 subscribers
  • Views 5309 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall rules not working as expected

SGICT

Hi,

I've rolled out many UTMs in the past and now starting to replace them with XGS, v19.

Pretty much makes sense but im puzzled by the firewall rules and how they are executed.

Here's one example that I dont get

I have simple LAN - 192.168.1.X that has Netgear wifi broadcasters attached to them.

I needed to create a guest network on those wifi broadcasters so created that with a VLAN, ID20, IP 192.168.100.x. Zone is LAN

Setup on the XGS the stuff required so Vlan interface, DHCP for vlan, etc etc.

The firewall rule is

All working fine, users are on guest, got internet, no problem. I can see clearly from the DHCP pool table that the guests are getting IP addresses for that Vlan segment.

However, as you see from the rule 0 B and 0 B for in and out.

I now wonder if the phones are just falling over to 4g because I look at the firewall logs and all I see is denies for anything from that network going out to the internet, not a single Allow.

Im really stumped because I dont know why its saying invalid packet or how to progress with this

Throwing a random idea but on UTM you had to create a masq rule for all networks needing the internet, I havent done that nor clicked on create NAT rule during the firewall rule setup. Should I have done or does the XGS handle that?

Many thanks in advance if you can help



Edited TAGs
[edited by: Erick Jan at 4:42 AM (GMT -8) on 15 Nov 2022]
  • 0

    Hi,

    If you only have one wan connection a simple masq rule will suffice.

    ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    there should already be a default Masq rule enabled for all internal networks going over your WAN Gateway.

    Have you checked, there is a WAN Gateway shown?

    Ping/traceroute to WAN from your XG and see if that works.

  • 0 in reply to LHerzog

    Thank you for your response, I dont think it is a masq issue, everything works but what I dont get is how, as you see in my original post anything on VLAN 20 has invalid packet, im not seeing any packets as Allowed but it still works. Now whether the phones are failing over to 4g, i dont know, then again I know this customer has dead spots with mobile network in their building so im surprised in a way they havent hit an issue.

    Ultimately im doing something wrong with that firewall rule and thought the "LInkedNAT" might be the reason why. Ive not created a NAT rule for 192.168.100.x, that is the VLAN20 network. Do i need too?

  • 0

    Firewall will be applied very soon in the connection table. This means, if you have 0 Bytes, the Client uses another firewall rule.

    Check the packet capture within the GUI to check, which Rule will be applied. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Ok perhaps Im really missing something obvious here.

    Im seeing tons of denies for the vlan 20 network as mentioned above. Ran PCAP

    I see this

    So there's no Rule ID or NAT ID or reason.

    I know the vlan is working, devices are getting DHCP and somehow they are browsing the internet absolutely fine yet I cannot find a single entry for any devices on 192.168.100 with a pass, everything is being denied.

  • 0

    You've set your Guest WiFi Network rule as #6. Are any of the five firewall rules above this also LAN-->WAN? Also your ___Guest_Wifi_Via___ is a host group covering the IP range 192.168.100.x? Is the DHCP specifying the gateway for that VLAN? If so, which port are you specifying on your firewall as the gateway for the VLAN?

  • 0 in reply to SGICT

    is the XGS directly connected to the WAN router or is there some upstream firewall or router in between. Maybe the route back to the XGS is missing on such a device because we see only outgoing, packets, nothing in. But this can also be a matter of your packet capture filter.

    please make sure you have that like:

    Is that 192.168.100.0 a new subnet in your infrastructure and some guys forgot to create it on all devices?

  • 0 in reply to LHerzog

    Yes, at some point it sounds like packets are taking two different routes, There was a recent article about this happening I think with SD-WAN or something but this particular use case sounds simpler and hence I was trying to ask questions (below) about perhaps there are wrong ports on the XGS being specified for some routing and even though it's a single box it might be confusing the session tracking. (Or, as you say, it could be two different routes or some device upstream.)

  • 0 in reply to SGICT

    Is this QUIC? UDP port 443 looks like Google QUIC and you can block this in a firewall rule. 

    BTW: 

    Go to your firewall rule. Try to edit all your affected host objects and hit save. Does it work or do you see Errors /loadings in the Webadmin? 

    I mean doing this: 

    +

    __________________________________________________________________________________________________________________

  • 0 in reply to Wayne Folta

    Hi Wayne,

    There are no rules above Guest Wifi that is LAN to WAN

    The - ___Guest_Wifi_Vlan20 object is this

    IP version    IPv4
    Type    Network
    IP address  192.168.100.0
    Subnet /24 (255.255.255.0)
     

    The DHCP for this VLAN has "Use interface IP as gateway" ticked and auto fill with 192.168.100.1

    The last question, would you be kind enough to tell me where to check that?

Unfiltered HTML