Sophos XGS with functioning IPsec tunnel but no internet access

Question

I work for a small university with a main campus and a single, annex building which is off-site. I have configured a XGS 2100 with an IPsec tunnel between the locations, which is working great. The problem is that I have no internet traffic from my LAN at the annex building where the XGS is located. 
 Config: 
 WAN: 23.25.185.x/29 
 LAN: 10.192.234.1/24 
 Connecting interface on switch: 10.192.234.2 
 here's my route table: 
 
 All networks show above which are assigned to SFC_LAN are in the IP Group "SFC Network Group" 
 Here is the rule I've created to allow internet traffic: 
 
 I know the WAN interface is working correctly based on the fact that my IPsec tunnel is working fine. 
 I dont have any rules above this one which deny traffic. 
 I dont have any rules which specifically permit traffic to the LAN zone (except the rules for the IPsec tunnel). 
 What on earth am I missing here?

emmosophos · Accepted Answer

Hello Josh, 
 So the Firewall rules only allow traffic from X source to Y destination, nothing else. 
 The NAT rules allow you to translate/change IP addresses between networks, like a mediator. Like you can tell from the Firewall, if you see a packet coming from Network A going to Network C, make it look (NAT) as if it&rsquo;s coming from Network B. 
 Since the "internet" don&rsquo;t allow Private address to be routed on the internet, you need to Source NAT (Masquerade) the traffic as it goes out of your LAN network. 
 So you can enable the one that says Default SNAT IPv4, and that should cover your traffic going out of the WAN interface. 
 I am leaving here this video , which should help you clarify things about the Firewall Rules and different NAT rules. 
 Regards,

emmosophos · Answer

Hello there, 
 Thank you for contacting the Sophos Community. 
 Do you have the NAT rule that matches the traffic from your LAN 10.192.234.1 going to the WAN zone? Is the Default SNAT IPv4 NAT rule enabled? and MASQ selected under (SNAT) and the Outbounf interface is using the Correct Port? 
 If you have the correct SNAT rule, you might want to do a GUI Packet Capture to see if the traffic is actually hitting any rule and if so what rule. 
 Regards,

Sophos XGS with functioning IPsec tunnel but no internet access

Top Replies