Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Replies 22 replies
  • Subscribers 35 subscribers
  • Views 35902 views
  • Users 0 members are here
Options
Suggested

Sophos Firewall: Using NAT to achieve NTP proxy like functionality

Rob Andrews

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

Table of Contents

Overview

The new engine provides great flexibility when solving interesting network problems.  I don't know if it has been shared here, but you can use NAT to achieve NTP proxy-like functionality.  A standard use case seen is that clients would like to use the IP address of the firewall as the NTP server. Consider this as an example environment:

  • The firewall has at least two interfaces: LAN and WAN. The LAN interface has an RFC1918 address, and the WAN interface utilizes a public address.
  • Clients behind the firewall would like to use the LAN interface IP as the NTP 'server'. In this regard, the default gateway and NTP destination on your clients use the same address.  
  • The NTP server you want to sync with is external to the organization, e.g. pool.ntp.org.

Types of Transparent NTP

There are two different approaches to a transparent NTP solution. 

1. NTP must be forwarded to a specific external (WAN) host/host group.

2. NTP must be forwarded to its resources within the network, and this server must provide the information. 

1st Scenario

The first scenario is rather simple.

It would be best to have one NAT Rule, which translates everything NTP-based to a specific host. 

You can specify all internal hosts with "Interface matching criteria - Inbound Interfaces". 
This example shows ANY. You can select all internal network interfaces (except WAN). 

This rule will fetch all NTP-related traffic, forward it to a public NTP service, and use MASQ. MASQ is required for WAN-related traffic. 

It would be best if you had a firewall rule: 

You can attach IPS rules to this if you want.
Build your own NTP rule with all NTP-related IPS patterns. 

Regardless of the configured IP on a client behind Sophos Firewall, the NTP request will work.
(Example: 1.2.3.4)

2nd Scenario

The second scenario needs more rules, as you can easily generate an NTP loop. 
Your internal server needs its own NAT rule and firewall rule. 
Example = Windows2016 is a NTP server. 

NAT Rule 1# 
NTP Server to WAN (to get the NTP server to the WAN NTP servers.)
You can also force the internal NTP server to get the IP from a specific NTP pool, but we assume the NTP server has its own NTP request pool. 

NAT 2# 
It’ll forward the NTP traffic transparently to the internal NTP server. 

 Firewall rules:

Firewall rule #1

Allowing the traffic of the NTP server to the WAN to get current time. 

 Firewall rule #2

Allowing the Traffic from all internal clients to the internal NTP server. 
Notice the destination zone. 

You can naturally create variations of this NAT policy based on your network configuration and the location of the NTP server.



Revamped RR
[edited by: Erick Jan at 9:14 AM (GMT -7) on 18 Sep 2024]
Parents
  • 0

    Hi Rob,

    IMHO this is an interesting tip - would be cool to see more of these here in the forum. :-)

    I'm doing something similar, but more or less "inverted":

    I'm using the NAT rules to catch all DNS traffic on port 53 tcp/udp and forward it to the XG itself. This way I can avoid any traffic to unwanted nameservers from devices that cannot be reconfigured, e.g. Amazon Echo speakers with hardcoded 8.8.8.8.

    Best Regards

    Dom

  • 0 in reply to Dom Nik

    Yes, Dom, that's another great example.

    In fact, we have a very similar example of that in our training.  You can steer DNS traffic, any service in fact, to the respective sanctioned servers. 

     

    Here's another odd-ball example you can noodle on that I've used NAT for: Imagine you have a network device that is incapable of setting a gateway address, it only has a network address and subnet mask.   Now imagine you have a client that is on a different network that needs access to said device.   As that device can't route out, you wouldn't traditionally be able to access it.  Using creative NAT policies you can get to that local network and manage the device. 

Reply
  • 0 in reply to Dom Nik

    Yes, Dom, that's another great example.

    In fact, we have a very similar example of that in our training.  You can steer DNS traffic, any service in fact, to the respective sanctioned servers. 

     

    Here's another odd-ball example you can noodle on that I've used NAT for: Imagine you have a network device that is incapable of setting a gateway address, it only has a network address and subnet mask.   Now imagine you have a client that is on a different network that needs access to said device.   As that device can't route out, you wouldn't traditionally be able to access it.  Using creative NAT policies you can get to that local network and manage the device. 

Children
Unfiltered HTML