Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Using with ONE LAN interface GATEWAY

Hello,

I try@home to migrate from UTM zu SFOS. On the good old UTM there was only one LAN Interface. This was the gateway for some PCs.

At the network configuration on the UTM, I configured the real-router-getway as gateway in this one UTM NIC. It has worked.

Now at SFOS I cant configure a gateway at the LAN (also only one NIC) interface.

What would be the 1:1 configuration for SFOS like the UTM was?

best regards

michael



Added TAGs
[edited by: Erick Jan at 12:46 PM (GMT -7) on 5 Sep 2024]
Parents Reply Children
  • And how are you routing "on this firewall"? 
    Or whats your outcome here? 
    Because yeah, you can do this on SFOS too, and it will work. But how does a client interact with this firewall? Is the default GW for your client the 192.168.0.200? 
    Essentially: You can get this working on SFOS too, but not sure if this is really something worth following up. VLANs and a clean cut of interfaces are more applicable. 

    You would have to MASQ the traffic on the same subnet and send it weirdly in the network from a to b. 

    And you would do this by using a static route. Simply build a static route for 0.0.0.0 to the 192.168.0.25. 
    Do not forget the MASQ Rule. 

    __________________________________________________________________________________________________________________

  • Thank you - I will try it.

    It seams the UTM needs NO gui-configured routing... it routed all to 192.168.0.25 only with the configured GW at NIC level.

    yes .200 is the default gw for some clients at home. Until now no vlan at home is needed - maybe the children will do some hacks at layer2-x level ...

    Also .200 is an 'exposed host' via german fritzbox; so I can .200 use with ssl vpn from external or do some NAT from external through the fritzbox.

  • SFOS only allows a standard gateway to be placed on a WAN interface. Doing a WAN interface has other implications like device access acls and certain mechanism are not working. 
    Therefore its easy to work with a LAN zone and using 0.0.0.0 route to your GW instead. 

    __________________________________________________________________________________________________________________