Web Server on VLAN

Are there any online resources anywhere for what I am trying to do specifically? I am trying everything and it is still not working, I have looked but I could not find anything specific to what I am trying to do.

There is either a problem with your rule or your isp blocks the port. One other item, the server might not like the external addresses, check whether the server has a valid list of allowed networks?
ian

My ISP does not block any ports, I currently have a pfsense firewall setup and everything works on that. I wanted to upgrade from pfsense to Sophos Firewall due to features etc. As I am new to Sophos Firewall I may need to view some tutorials etc as the setup assistant cannot get the incoming traffic onto the specified VLAN. I am sure I am missing something but unless I see the steps of what is missing I am at a loss. I have also followed the documentation links on this post and still nothing. Outgoing traffic works fine on the server and internet access it is just incoming traffic to the VLAN and Webserver which I am struggling with.

Please check and verify traffic flow under MONITOR & ANALYZE || Diagnostics || Packet Capture passing from the same firewall rules with help of tcpdump and drop packet to investigate the issue. 

Please share the output to assist you 

So, I think I am missing something here when it comes to the Sophos Setup Assistant for DNAT. When I launch it, I get prompted for the Internet IP of the Webserver which I added under Hosts and Services. I then get asked for the Public IP which again I added via Hosts and Services. Then services to allow and who externally can access these internal services which is any.

It creates the DNAT with loopback and Reflective rules including an incoming firewall rule. My issue is I am not defining when the incoming traffic hits the LAN that it then gets filtered to the specific VLAN with that static IP.  There is clearly a step missing here as the switch has three VLANs and unless the incoming traffic knows which VLAN to look for it won’t pass the traffic.

I added the Webserver VLAN #Port1.40 to the DMZ zone, but it did not make much of a difference. So, based on this can someone explain if I have missed a step with routing the traffic I saw somewhere someone bridged the ports and added a static route but not sure if this is needed.

Please find below screenshots of rules

More

Tcpdump and drop will help you understand traffic is passing or not 

Logs

As you can see from these logs those highlighted in green are the allowed ones matching from my web server VLAN, I just need to do the reverse to match on the incoming. I have attached the Google Doc link below

By looking into traffic with tcpdump we have updated DNAT rule Inbound Interface as ANY and Outbound interface as VLAN website started working