Sophos XGS: DNAT Through Routed VPN

Hello,

you are trying to reach a server at 192.168.10.5 /24 from the local LAN with 192.168.10.0 /24.

This traffic will never hit the router (= gateway), because that traffic is inside your LAN and will stay there, no need to involve the gateway.

So basically, you can configure very sophisticated rules and settings at the Sophos XGS, but that won't work.

Are you trying to avoid changing the Server-IP at the clients?

Thanks for your input, Philipp! Actually, I'm trying to redirect all the requests made from 192.168.10.0/24 to a server at 192.168.10.5 (Local-IPSec VPN) to another server (via IPSec VPN) at 172.16.10.5.

True, i missed this: 

Maybe PFsense is solving this differently, but what you have here is: 
As there is no device to answer to this IP in your network, SFOS will also not do an ARP for it. 
The client will reach out with an ARP to look for 192.168.10.5 - But SFOS is not responsible for it - So it will not answer and the SYN Paket will never be send. 

You can workaround this by putting the ALIAS IP of 192.168.10.5 on the LAN interface of the SFOS Firewall. Therefore we will reply to the ARP and then the connection will be routed. 

THAT sounds like a solution - good point!

Hey, I confess I thought about it, but with so many ideas at the same time, this one just disappeared. Now, after setting up this alias, the regular DNAT on the GUI interface is registering logs. That rule in the console, 'set advanced-firewall sys-traffic-nat add destination 172.16.10.5 snatip 192.168.10.5', didn't work. Thanks!!!! I'll keep finding a solution, and now I can capture packets and think better...

Hi FMXio, you may consider WAF over RBVPN IPsec to achieve what you have described. You will have to use RBVPN with local and remote subnets as Any and Any on SFOS.

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/WebServerProtection/WAF/Rules/WAFSDWANRoutes/index.html

Or you can follow the suggestion given by me @  RE: force outgoing through the xfrm interface  if that works.

In the NAT rule of SFOS, either chose MASQ if xfrm ip to be used or keep it as 'Original' and configure 192.168.10.5 on the LAN port of SFOS.

Toni, I appreciated it! This one worked beautifully.Thanks!!

LuCar Toni said:

You can workaround this by putting the ALIAS IP of 192.168.10.5 on the LAN interface of the SFOS Firewall. Therefore we will reply to the ARP and then the connection will be routed. 

Hello Naidu! Thank you. I'll check it out later. I actually sorted that issue out after adding an alias like Toni mentioned.

Hello Naidu! Thank you. I'll check it out later. I actually sorted that issue out after adding an alias like Toni mentioned.