Change SSL VPN Port

Hi,

Under System > Administration > Settings
Change the "User Portal HTTPS Port" port, this port too will be used for SSL VPN remote connection.

Thanks for the above. This was quite helpful as a workaround to get SSL VPN working for me. 

For some reason, my instance of XG did not seem to have the "Non-HTTP Based Policy", so I used the "DNAT/Full NAT/Load Balancing" template with the following settings:

For "Destination Host/Network", #PortB is my WAN port, while "Protected Server" is the LAN IP address for Sophos XG. 

It seems to work OK. 

One thing that surprised me a bit is protocol Selection under "Destination & Services". I would have though there would be an option to forward both TCP and UDP, and not just one or the other, but apparently you can't. Does that mean if I wanted both to be covered off, I would need two rules, one for TCP and another for UDP? That seems rather inefficient and a bit of unnecessary pain. Or did I just miss something to enable both?

I had initially tried UDP but that didn't seem to work behind an offsite firewall, so changed to TCP. When UDP is selected, the User Portal can still be accessed. Unfortunately, where I am they block UDP on 443 apparently, so I had to switch to TCP. Of course, doing this kills access to the User Portal from the internet, which is a bit of an irritation. It can still of course be accessed once the VPN is connected. That being said, if anyone knows a workaround so that both the User Portal and VPN are accessible (other than using 80 for the former), your thoughts would be most appreciated. 

Does this still work for you @MarcBorgers it doesn't seem to work anymore in the most recent Sophos XG.

FWIW on the most recent firmware update (16.05.3 MR-3) the port forwarding suggested by Marc also no longer seems to work for me.

Chris Schnobb said:

Does this still work for you @MarcBorgers it doesn't seem to work anymore in the most recent Sophos XG.

 

@MarcBorgers I tried this but it's not working !!

Hi SecuredNet,

the feature you are requesting will be shipped with SF 17.1 which is currently under testing and will hopefully releases soon.

Regards,

Holger

Holger,

Seriously..... it took you 2 years and you still haven't release this feature yet.

Sophos I remember you better than this

17.1 has been released and this feature is now there.

Alleluia !

One question by the way, is it possible to have both user portal AND vpn ssl on 443 port ?

It's possible to validate it through GUI, whitout error, but haven't been tested yet.

Hi guillaume,

port sharing is possible, so you can use port 443  for user portal and SSLVPN.

Best regards,

Holger

Hi SecureNet,

just in case you have not seen yet. In the current version of SFOS 17.1, this feature is implemented.

Best regards,

Holger

Hi SecureNet,

just in case you have not seen yet. In the current version of SFOS 17.1, this feature is implemented.

Best regards,

Holger

I have tried to change the port from 8443 to 443 using UDP mode and it fails saying there is a conflict on that port.

Everything else on the XG is using port 443 is TCP, e.g. WAF.

Can you confirm this is a bug, or how to fix it?  It is a significant benefit to have the UDP443 for SSL VPN and TCP443 for WAF

Thanks

Ian

Have you moved your user portal off 443?

hello

i can not respond on waf + ssl vpn on port 443, cause i don't use waf.

But in my opnion, it's an error to use 443 UDP, because it is usually blocked by firewalls on public access, like the other exotics ports, as 443 normal traffic is TCP and not UDP !

Thank you for your comments.

I agree 443 UDP is not as good as 443 TCP for getting through general public firewalls, but unless we can generate a WAF rule to use a specific address (as per SNI for HTTPS), then I am limited to the options available.

WIth regards to 443UDP vs other ports, Yes I agree 443UDP is more likely to be blocked in comparison to 443TCP, but it is significantly more likely for non 443 ports to be blocked and 443UDP to be open and acceptable.

Also SSL VPN supposedly has better performance on UDP than TCP (according to the setup options, I have never had the opportunity to find out)

Thanks

Ian

Hello.

Yes I moved the user portal from 443 to 444 when I tried it, and I have just tried again now with no luck

I get the red pop up box saying "The selected Port is already used by another service. Please choose a different Port."

Thanks

Ian

Also tried, you can not use 443 tcp or udp for vpn ssl and/or user portal since you activate a waf with https rule (and the contrary)

should be great if sophos let choice on which port/public ip vpn ssl and user portal listen as it could be possible to have waf on one port/ip AND ssl vpn on an other port/ip.

but it's not the case..

Hello,

I can use 443 for WAF and User Portal, this is my normal configuration.  I assume this is because WAF is only available on WAN IP And User Portal from various local interfaces.

As SSL VPN can use all interfaces, I assume this has an effect on why it cannot be enabled.   On that note, I have just disabled SSL VPN from ALL interfaces and tried again, but still an error.