Enable Routing for public IP on the Lan Interface

Hi Luke,

Thank you for reaching out to Sophos Community.

Have you checked the packet to see if it’s being translated properly or routed?

You may also try to do a Port-forwarding 

Hello Erick,

Thanks for the reply. I want to have the packets routed to the internal Interface so that i can use the individual public IP address of the servers.

When I try to ping another server outside of the subnet no packet seems to arrive.

How should I correctly setup the routing sot that packets get sent?

Thank you for your help.

Hi,

Have you created a Firewall Rule and a NAT rule to translate the IP?

You may check the following KB regarding NAT :

• Create a source NAT rule
• Port Forward
• NAT 

Also, Sophos Assistance might help you configure your NAT.

Also, do a packet capture/TCPdump to check packets and the log viewer for errors.

•  Sophos Firewall: How to TCPdump 

Hello Erick,

I've now created a Firewall Rule and a NAT for the public IP to an internal IP. I've assigned the public IP to an alias on the wan Interface.

Using the tcpdump i can see that the traffic arrives at the server with the internal IP and gets sent back. I can see in the tcpdump on the Firewall that the traffic from the internal IP to the Internet gets translated and the source changes to the public ip. Unfortunately no packet arrives on the client. I can also see on the NAT rule overview that the Reflexive NAT Rule doesn't report any usage.

Let me know if you have an idea.

When using the DNAT wizard you will also get the option to create a reflexive NAT rule to have the server use the specified IP when accessing the internet. Tick that option and make sure this NAT rule comes before your general SNAT rule for all other clients.

When using the DNAT wizard you will also get the option to create a reflexive NAT rule to have the server use the specified IP when accessing the internet. Tick that option and make sure this NAT rule comes before your general SNAT rule for all other clients.

I already did that and for some reason it doesn't work...