This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos V19.5 - No SNAT but still running ?

Hello,

I'm using XG135 with latest firmware SFOS 19.5.0 GA-Build197.

My fw rule for outgoing traffic to Internet like this (rule ID 10):

When I look into NAT rule, I see that the SNAT rule for outgoing traffic to Internet has the number of usage still zero (0). I turn off this SNAT too to see what happen (rule ID 6 is disabled):

And can you believe this situation, I can still connect to Internet as normal when I don't have the SNAT rule.

Please help me, what happens with my product and how can I fix it, thank you.

Auto Copied

This thread was automatically locked due to age.

Top Replies

rfcat_vk over 1 year ago in reply to Vu Xuan +2 suggested

Hi, that is not your address of your external interface, that is the address after the cgnat, please check your trace for details. ian

Parents

0 Erick Jan over 1 year ago

Hi Vu Xuan,

Thank you for reaching out to Sophos Community.

Would it be possible to share a log viewer for the said traffic or packet capture to determine on which rule it’s passing thru?

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vu Xuan over 1 year ago in reply to Erick Jan

Hi,

I turn on the log traffic option for the Internet FW rule and here is the log viewer:
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan over 1 year ago in reply to Vu Xuan

Hi Vu Xuan,

Based on the log viewer, the Traffic rule is passing thru your rule ID 5 and NAT rule 0

Nat rule 0 indicates that there’s no NAT modification applied.

For further reference, you can view this at NAT RULE 0

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vu Xuan over 1 year ago in reply to Erick Jan

Hi,

Sorry but I don't understand if there is no NAT modification, why my packet still can go to Internet ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan over 1 year ago in reply to Vu Xuan

Sorry about that. I got confused. You're right. This should not work if the NAT is already dropped.

But this indicates that it’sn't linked to your ID 6

Can you share a screenshot of a traceroute going to the internet? There might be a loop or a backdoor.

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vu Xuan over 1 year ago in reply to Erick Jan

Hi,

Tracert as below, first go to my Sophos 10.1.0.2 then go to Internet like normal:

As I type this reply to you, I'm going to Internet though my Sophos without SNAT rule as above.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 1 year ago in reply to Vu Xuan

Hi,

looking the trace detail it would appear as though your ISP has a NAT (CGNAT) on their network which would explain why your 10 address is working fine.

Ian

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 rfcat_vk over 1 year ago in reply to Vu Xuan

Hi,

looking the trace detail it would appear as though your ISP has a NAT (CGNAT) on their network which would explain why your 10 address is working fine.

Ian

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel

Children

0 Vu Xuan over 1 year ago in reply to rfcat_vk

Hi,

Thank for your reply but if my ISP use CGNAT, why I still see my public IP correctly on Internet and other services like NAS, CCTV still work with my public IP ?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 1 year ago in reply to Vu Xuan

Hi,

that is not your address of your external interface, that is the address after the cgnat, please check your trace for details.

ian

XG115W - v20 GA - Home

XG on VM 8 - v20 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +2 Vote Down

Cancel
0 Vu Xuan over 1 year ago in reply to rfcat_vk

Hi,

That is exactly my WAN IP address and my CCTV service also runs on that WAN IP for several years.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 1 year ago in reply to Vu Xuan

Hello,

Your traffic is going out using Firewall ID #5

If you want to identify what NAT rule is being applied for this traffic do a GUI PCAP, and it’ll show you the NAT.

From there, you can investigate why this FR is taking precedence and change it accordingly.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel