Enable Routing for public IP on the Lan Interface

Hi Luke,

Thank you for reaching out to Sophos Community.

Have you checked the packet to see if it’s being translated properly or routed?

You may also try to do a Port-forwarding 

Hello Erick,

Thanks for the reply. I want to have the packets routed to the internal Interface so that i can use the individual public IP address of the servers.

When I try to ping another server outside of the subnet no packet seems to arrive.

How should I correctly setup the routing sot that packets get sent?

Thank you for your help.

Hi,

Have you created a Firewall Rule and a NAT rule to translate the IP?

You may check the following KB regarding NAT :

• Create a source NAT rule
• Port Forward
• NAT 

Also, Sophos Assistance might help you configure your NAT.

Also, do a packet capture/TCPdump to check packets and the log viewer for errors.

•  Sophos Firewall: How to TCPdump 

Hello Erick,

I've now created a Firewall Rule and a NAT for the public IP to an internal IP. I've assigned the public IP to an alias on the wan Interface.

Using the tcpdump i can see that the traffic arrives at the server with the internal IP and gets sent back. I can see in the tcpdump on the Firewall that the traffic from the internal IP to the Internet gets translated and the source changes to the public ip. Unfortunately no packet arrives on the client. I can also see on the NAT rule overview that the Reflexive NAT Rule doesn't report any usage.

Let me know if you have an idea.

Hello Erick,

I've now created a Firewall Rule and a NAT for the public IP to an internal IP. I've assigned the public IP to an alias on the wan Interface.

Using the tcpdump i can see that the traffic arrives at the server with the internal IP and gets sent back. I can see in the tcpdump on the Firewall that the traffic from the internal IP to the Internet gets translated and the source changes to the public ip. Unfortunately no packet arrives on the client. I can also see on the NAT rule overview that the Reflexive NAT Rule doesn't report any usage.

Let me know if you have an idea.

When using the DNAT wizard you will also get the option to create a reflexive NAT rule to have the server use the specified IP when accessing the internet. Tick that option and make sure this NAT rule comes before your general SNAT rule for all other clients.

Do you want to use the server IPs form clients behind the firewall? And these are in a different zone / at a different interface?

I already did that and for some reason it doesn't work...

My original approach to this was to use NAT. But after that didn't work i switched to routing which still doesn't work aswell.

On my second approach I gave the Servers behind the firewall an IP from our public IP Subnet. Then I switched to routing which unfortunately didn't work aswell.

I may have a solution but I will have to try it first. I will keep you updated!