First time user looking to switch from another product due to it being sold and stripped

Question

Sophos Firewall is NOT very intuitive so far. Nothing inbound works...but the default rules to let everything outbound does. So figured id ask the community. 
 I've reverted to the simplest test I can think of....Port forward ICMP from WAN to a LAN workstation.. 
 First turned on ICMP on the WAN adapter to make sure it was listening from outside. It was so I turned ICMP off. 
 Second made sure the Firewall can reach the workstation using its LAN connection, it can

Created the Rule, 
 WAN, Any, to LAN, workstation 172.16.16.17 with the predefined PING 
 
 .Nothing. System isn't logging it. Just nothing. Cant forward anything. 
 At this point I cant test the system because it doesn't even port forward. Lots of time wasted trying to figure out why this easy test is so hard. Thanks

LuCar Toni · Answer

The Firewall Rule needs to be: WAN ANY - LAN + WAN IP + Ping 
 Use the NAT Assistance to do a DNAT. You find the Guide in the online help: https://doc.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/NATRules/RulesPoliciesCreateDNATAndFirewallRulesForInternalServers/index.html

LuCar Toni · Answer

You can move to the advanced Shell (Option 5 + Option 3) and then use the linux to check whatever you need. Like use ifconfig Port1 to find the MAC Address. 
 Keep in Mind: SFOS behave the same if virtually or physically installed. So the installer for hardware as well as software is the same.

LuCar Toni · Answer

You find more information about NAT also here: https://techvids.sophos.com/watch/qQzynSUroGrH9KzEGSnkPA

LuCar Toni · Answer

You have MASQ for the DNAT Rule. So the appliance will MASQ the DNAT Traffic.

#1 W49 < G33

Source: Any host 
 Service: PING, Dest TCP 11799 
 Destination: WAN 49

Source: MASQ 
 Service: Original 
 Destination: Green 192.168.2.33

Inbound: Any interface 
 Outbound: Any interface 
 Last used: 2023-12-13 19:33:07

midnightSun · Answer

It seems the issue is my using IP address or group names instead of #Port2:0 in the rules. Lesson learned. Thanks for your help.

LuCar Toni · Answer

Use one NAT per Service you want to NAT. I would not recommend to mix multiple services within one NAT especially due the overview nature. 
 So if you do not mix, it can be mapped. What kind of service use TCP and UDP at the same time? Most services are actually TCP or UDP and not both anyway.

First time user looking to switch from another product due to it being sold and stripped

Top Replies