Sophos Firewall Home Edition - Possible issue with WebUI Diagnostics – Traceroute and Ping failing to VLAN via LAN interface

Hi everyone,
I hope you can help me out here. 

I found something quite strange, but since I just started using Sophos recently, I might have misconfigured something.

Via WebUI, when I go to Diagnostics and try to run a ping or traceroute to a specific VLAN using the LAN interface, I always get 100% packet loss on ping, and on traceroute I see multiple host unreachable (!H) responses.

However, when I perform the exact same test via the CLI (console), everything works fine. I can ping the destination and get a proper traceroute result.

Here is an example of the WebUI traceroute output:

Traceroute to 192.168.7.2 (192.168.7.2), 30 hops max, 46 byte packets
 1  *  *  *
 2  192.168.1.235  48.110 ms !H  *  *
 3  *  192.168.1.235  68.253 ms !H  *
 4  *  *  192.168.1.235  68.085 ms !H
 5  *  *  *
 6  192.168.1.235  68.925 ms !H  *  *
 7  *  192.168.1.235  67.119 ms !H  *
 8  *  *  192.168.1.235  68.349 ms !H
 9  *  *  *
10  192.168.1.235  67.822 ms !H  *  *
11  *  192.168.1.235  68.479 ms !H  *
12  *  *  192.168.1.235  67.992 ms !H
13  *  *  *
14  192.168.1.235  70.116 ms !H  *  *
15  *  192.168.1.235  68.280 ms !H  *
16  *  *  192.168.1.235  69.090 ms !H
17  *  *  *
18  192.168.1.235  69.123 ms !H  *  *
19  *  192.168.1.235  74.238 ms !H  *
20  *  *  192.168.1.235  65.492 ms !H
21  *  *  *
22  192.168.1.235  68.467 ms !H  *  *
23  *  192.168.1.235  73.351 ms !H  *
24  *  *  192.168.1.235  69.655 ms !H
25  *  *  *
26  192.168.1.235  63.660 ms !H  *  *
27  *  192.168.1.235  68.248 ms !H  *
28  *  *  192.168.1.235  68.541 ms !H
29  *  *  *
30  192.168.1.235  68.723 ms !H  *  *

192.168.1.235 is my Sophos firewall
192.168.7.2 is a device on one of my VLANs

And here is the same test via shell:

SFVH_KV01_SFOS 21.5.0 GA-Build171# traceroute 192.168.7.2
traceroute to 192.168.7.2 (192.168.7.2), 30 hops max, 46 byte packets
 1  192.168.7.2 (192.168.7.2)  3.293 ms  1.035 ms  1.141 ms

Could this be a bug? Or am I doing something wrong? Any help would be greatly appreciated!

Thanks in advance.



Added TAGs
[edited by: Erick Jan at 12:16 AM (GMT -7) on 24 Jul 2025]
  • Did you try traceroute with -i for Interface? 
    Because that is what you do, if you select the interface in the Diagnostic. 
    See: 

    -i interface
    Specifies the interface through which traceroute should send packets. By default, the interface is selected according to the routing table. 

    __________________________________________________________________________________________________________________

    • Both in the traceroute and ping I select the interface LAN. Via Shell I didn't try using -i but I did now and I am having the same via webui

      SFVH_KV01_SFOS 21.5.0 GA-Build171# traceroute -i PortA 192.168.7.1
      traceroute to 192.168.7.1 (192.168.7.1), 30 hops max, 46 byte packets
       1  Sophos_fw (192.168.1.235)  3061.948 ms !H  3071.180 ms !H  3071.915 ms !H

      I suppose the issue is because I don't have a rule?

      • Traceroute with the -i parameter basically means, it tries to reach your host from that interface. 
        If there is "no route to the host" we never receive any reply. 
        Without the Interface, you will get the best fitting route by the Kernel. 
        But if you give an Interface, we try to reach the target by using your interface, which in your example, will lead to a timeout (we are not able to reach it). 

        __________________________________________________________________________________________________________________

        • Thanks for the explanation, that makes sense.

          However, I’m still a bit confused.

          Even after creating a firewall rule to allow communication between the VLAN and the physical interface network, the firewall still doesn’t seem to find a valid route.

          Is there any additional configuration I might be missing?

          Should I manually add a static route or enable something else to allow traffic between a physical interface and a VLAN interface on the same device?

          Any guidance would be appreciated.

          • For directly connected subnets, you don't need a separate route.

            The destination device has the sophos as default gateway configured? Otherwise, it don't know the "LAN-Network" is reacheble over the sophos. (answers to devices within the same NetworkSegment are possible without route or def-GW ... so a ping without selected interface can be answered)

            However, it is possible too, that a higher-priority SD-WAN route is redirecting traffic via the wrong interface.  


            Dirk

            Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
            Sophos Solution Partner since 2003
            If a post solves your question, click the 'Verify Answer' link at this post.