Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 14 replies
  • Answers 3 answers
  • Subscribers 41 subscribers
  • Views 2615 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Using with ONE LAN interface GATEWAY

forum-astaro-org

Hello,

I try@home to migrate from UTM zu SFOS. On the good old UTM there was only one LAN Interface. This was the gateway for some PCs.

At the network configuration on the UTM, I configured the real-router-getway as gateway in this one UTM NIC. It has worked.

Now at SFOS I cant configure a gateway at the LAN (also only one NIC) interface.

What would be the 1:1 configuration for SFOS like the UTM was?

best regards

michael



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I'm a bit confused by the design.
    you place 2 doors within the same network and hope your users & devices use the correct one?
    Some other applications may "see" the other door and ignore the correct way.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    Moin, its only for home-use and family. Theoretically every smartphone via USB on a PC is a door :-) They have no local admin/root-rights on the devices, so the GW is 'secure'. The main use-case are the proxy-blacklists.

  • 0 in reply to forum-astaro-org

    While your setup may fit your needs and they have no local admin on the devices they might be able to start their devices with a linux live environment and go directly to the fritzbox as gateway.
    Why not simply add a 2nd NIC in the machine and do proper LAN to WAN routing with no easy options to bypass the firewall (other than physically plugging cables)?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Reply
  • 0 in reply to forum-astaro-org

    While your setup may fit your needs and they have no local admin on the devices they might be able to start their devices with a linux live environment and go directly to the fritzbox as gateway.
    Why not simply add a 2nd NIC in the machine and do proper LAN to WAN routing with no easy options to bypass the firewall (other than physically plugging cables)?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Children
  • 0 in reply to apijnappels

    For routing I need 2 different networks. But I wont change all LAN Client-IPs and I will not change the IP of the Fritzbox-Router and the Router can only handle 1 IP on its LAN Interface. To be really secure I also need a tresor to prevent plugin a RJ45 Cable to the Router, better a MDM, NAC, glue up all USB-Ports and lock up all pc-housing, authenfication only with an RFID Implantat to every family members forehead.

  • 0 in reply to forum-astaro-org

    Sure, you could do all that. But I see now you don't want anything to change and are not willing to change LAN Client IP's which may all have static IP's now to have a reservation in the DHCP server so they still have a "fixed" address.

    We just tried to advise you on a situation that would give better protection and would make better use of the capabilities of the firewall. If that is not what you are looking for then I think in that case Lucar Toni's answer might be your best option.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    I want more a technical discussion than a preaching morality

  • 0 in reply to forum-astaro-org

    But right now, everybody can simply change there Gateway to the fritzbox, completely bypassing everything? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Everybody can simply plugin a 5G Stick and completely bypassing everything. Normal OS have a right-management, so not everybody can change the gateway.

  • 0 in reply to forum-astaro-org

    So, which question is open? As stated, you can do a Route 0.0.0.0 and this will work. 

    __________________________________________________________________________________________________________________

Unfiltered HTML