Web Server on VLAN

Hello,

Thank you for contacting Sophos Community!

You need to create the DNAT.

docs.sophos.com/.../index.html

docs.sophos.com/.../index.html

Hi,

In addition, you may also use Sophos Assistant to configure DNAT.

Hi Erick,

I have tried using Sophos Assistant to configure DNAT and it creates the rules but I am still not getting any traffic on my web server.

Thanks

Mark

You may refer - Configure a port forwarding rule.

Hi

Again, to further check, do a packet capture/tcpdump to see what has transferred with the packet. 

Hi Erick,

I did a packet capture and no traffic is being translated from WAN to LAN/VLAN. I have manually followed https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/NATRules/RulesPoliciesCreateDNATAndFirewallRulesForInternalServers/index.html#specify-firewall-rule-settings-for-the-dnat-rule and created the rules.

No incoming traffic is being translated to the LAN/VLAN port.

Hi,

Kindly make a test firewall rule from WAN going to your web server and put it on the top FW policy.

Also, check logviewer/packet capture.

hi,

nearly every time, the wizzard creates a running config, if correct parameters are provided.
what do you use for external port/ip ?
try ##Port2 (or your WAN interface) for example

This is the config generated by the firewall for the webserver via DNAT

It automatically creates the incoming firewall rule but still not getting anything on this?

Ports

#Port1.40 is Webserver (VLAN)

#Port2 WAN

#Port1 LAN

This is the config generated by the firewall for the webserver via DNAT

It automatically creates the incoming firewall rule but still not getting anything on this?

Ports

#Port1.40 is Webserver (VLAN)

#Port2 WAN

#Port1 LAN

next, i would check the logviewer.

Enable logging on all related rules and create a "deny any and log" rule at the bottom.

Enable logging for "local acls"   (Configure > System services > Log settings)

Now you should see some hits for incoming traffic.