3CX DLL-Sideloading attack: What you need to know

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 12 replies
  • Answers 2 answers
  • Subscribers 28 subscribers
  • Views 4009 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VLAN clients receives IP from DHCP but can't access internet

dsurfer

Hi! I've created a new VLAN and DHCP server for it on the firewall. The clients on the VLAN can successfully get an IP address from the DHCP server but cannot resolve websites / or have internet access. Any tips? See below DHCP server config & firewall rule:



This thread was automatically locked due to age.
Parents
  • 0

    please check the value your wifi network is showing to see if it matches your dhcp settings.

    ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    So right now I haven't connected any clients from the WIFI network yet, as I want to make sure this works first. So for now I've just dedicated a switch port to the new VLAN and have a wired laptop into it. It gets a proper IP address from the DHCP server, just no internet.

Reply
  • 0 in reply to rfcat_vk

    So right now I haven't connected any clients from the WIFI network yet, as I want to make sure this works first. So for now I've just dedicated a switch port to the new VLAN and have a wired laptop into it. It gets a proper IP address from the DHCP server, just no internet.

Children
  • 0 in reply to dsurfer

    Hi dsurfer 

    As per the firewall rule, LAN is the source zone, the same is applied to VLAN.

    If changing to the proper zone doesn't help check packet capture under MONITOR & ANALYZE-->Diagnostics-->Packet Capture Click on configure Enter BPF string host 8.8.8.8 and proto ICMP to verify the firewall rule.

    Also, check DNS on System is getting resolved, and share any error message from the browser in case the internet not working 

    Regards

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    Thanks, yes, the Zone is confirmed to be LAN on the VLAN interface and the source on the firewall rule. I tried doing a capture packet with the host string 8.8.8.8 and no records come up.

  • 0 in reply to dsurfer

    Are you connected on Windows ?

    1.Share ipconfig /all 

    2.nslookup sophos.com

    3.tracert -d sophos.com 

    4. From SSH of Sophos XG check 

    console>tcpdump 'host 8.8.8.8 and proto ICMP

    console>dr 'host 8.8.8.8 and proto ICMP

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    Yes it's a windows machine that I have testing here:

    I'll do the XG console commands in a few min

  • 0 in reply to dsurfer

    Share the VLAN setting with a screenshot, for troubleshoot the issue created lan to wan firewall rule as per below settings : 

    From SSH of Sophos XG check 

    console>tcpdump 'host 8.8.8.8 and proto ICMP

    console>dr 'host 8.8.8.8 and proto ICMP

    Make continuous ping to 8.8.8.8

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    Rule is at the top:

    The console command doesn't seem to do anything, or it's waiting: 

    (Thanks for your time with this! I'll return in about 1.5 to 2 hrs, I have appt thanks)

  • 0 in reply to dsurfer

    Please select "any" on source network 

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    Selecting "any" didn't give internet access to the machine on the VLAN. Also if I put "any" there, then it's exactly the same firewall rule as the Default Network Policy rule (towards the bottom):

  • 0 in reply to dsurfer

    Hello there,

    Thank you for contacting the Sophos Community.

    Adding to what has been mentioned, try doing a GUI Packet Capture to confirm if the traffic is hitting a specific Firewall Rule and NAT rule.

    Diagnostics >> Packet Capture >> Configure >> Under "Enter BPF String" enter 192.168.200.101 >> Save >> Turn On 

    Note: Use the actual current IP of the Windows computer

    After that do a ping to 8.8.8.8 and see what the Packet capture shows, you might need  to click "Refresh"

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to emmosophos

    Thanks! The solution was given to me by bharat J to create a NAT rule (see below) and set it at the top of the rules:

Unfiltered HTML