FIREWALL RULE OVER VPN (WAN-VPN)

Hello,

Do you see any denied message? I believe you have allowed it under VPN to WAN and has linked NAT rule.

I didn't see any denied or error message. Does it require another NAT rule for this? i created an NAT rule as a general rule for my firewall rule.

I didn't see any denied or error message. Does it require another NAT rule for this? i created an NAT rule as a general rule for my firewall rule.

Hello,

It does not require dedicated rule as far as it got general NAT rule available. Also, attached error snapshot.

Kindly collect the packet capture under Monitor & Analyze -> Diagnostics -> Packet Capture. Add string as host yahoo.com.

Browse the yahoo.com and review packet capture. Also your devices are running on too old version. This must be upgraded to supported version.

This is what i've got when browsing yahoo.com. 

Also, please see packet capture



Is there anything I need to configure?

Hello,

I have sent request. Kindly accept and DM me.

Hello,

Found there is IPsec site to site VPN and BO traffic Internet traffic routed via HO. Upon reviewing the logs for the mail.yahoo.com. We could see that it was asking to fragment the packet.

12:51:04.168887 ifb0, OUT: Out 7c:5a:1c:8e:20:51 ethertype IPv4 (0x0800), length 592: 161.x.x.x > 180.222.106.11: ICMP 161.x.x.x unreachable - need to frag (mtu 1406), length 556

12:51:04.168893 Port2, OUT: Out 7c:5a:1c:8e:20:51 ethertype IPv4 (0x0800), length 592: 161.x.x.x > 180.222.106.11: ICMP 161.x.x.x unreachable - need to frag (mtu 1406), length 556

12:51:04.168896 mv-pcimux0, OUT: Out c4:c5:c6:c7:c8:c9 ethertype IPv4 (0x0800), length 592: 161.x.x.x > 180.222.106.11: ICMP 161.x.x.x unreachable - need to frag (mtu 1406), length 556

 With the help of iptables command, we tweak the MTU size for the source/destination to made it work.

 Reference KBA:

 Sophos Firewall: MSS Clamping and IPsec Acceleration