Pass public IP address to LAN device

Hi Danny Webb

Thank you for reaching out to the community, you can refer to the following link to meet your requirement with proxy ARP 

https://support.sophos.com/support/s/article/KB-000035927?language=en_US#Configuring-Proxy-ARP 

If a post solves your question please use the 'Verify Answer' button.

Hi Bharat,

Thank you for your reply!

I am sorry, but I do not see how this shows me the public IP addresses on LAN devices instead of 172.16.16.16.

I have written a script that collects page access data and the homepage hits logs collect the public IP address. Before installing the Sophos FW, I used to see the public IP address from the visitor. Now I only see 172.16.16.16 as the WAN IP address.

Many thanks

Danny

Hi Danny Webb

Please check the traffic on Sophos XG with help of Packet Capture utility : 

https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Diagnostics/PacketCapture/index.html#captured-packet 

Take tcpdump as per the steps on the below link : 

https://support.sophos.com/support/s/article/KB-000037007?language=en_US

Please share the logs to get more details.

Thanks and Regards

What does your DNAT policy look like? Did you accidentally change the Source in addition to the Destination?

Hi Danny,

If you have invalid IP address on your web server like 172.16.16.X then you are probably using DNAT rule along FW rule. From Rules and Policies > NAT Rule, Find DNAT rule for your webserver. In configuration of that rule, change translated source from MASQ to Original. If you have problem in finding NAT rule, You can use packet capture.

Hi Farshid,

You are a genius. Thank you.

I found no existing SNAT or DNAT rules so I created a new DNAT rule for HTTPS from WAN to Web Server LAN IP and made sure the translated source was left to original as suggested.

I can now see the originating public IP Address in my logs on the LAN web server.

My sincerest thanks again Farshid

Danny

Glad to be helpful.