Sophos UTM Bridge Mode

You have to go into Advanced Bridge settings for the interface, and specify the Ethertypes that you want to pass.   A web search should take you to the master list of registered EtherTypes.

By default, only IPv4 packets are passed.   I use this list.  DHCP may not be included, because I do not need it.

0806
814c
8035
876b
86dd
880b

Thank you Douglas. 

I've done what you said, adding those ethertypes but still not working. 

eth0: 192.168.1.1/24

eth1: WAN (not connected) 

eth6: connected to router that has IP 192.168.1.254 and DHCP. 

eth7: Connectd to LAN

I can ping 4.2.2.2 or a web address, but when I open the browser I can´t. I've configured it as full transparent mode. 

The ideia is to allow all traffic in out, and allow VPN traffic, H323 and SIP from outside to the bridged network. The LAN/WAN confgiuration is only for management purposes. 

Do you have any suggestion about the configuration (see images, please)

Thank your for you help and concern, 

You forced me to check my facts.  DHCP uses UDP 67 and UDP 68, so it is passed automatically as part of the default EtherType.   Adding EtherTypes may be important, but not for this situation.    

I was surprised to see that the bridge has no IP Address.   That MAY be part of your problem if you are trying to pass DHCP between device on ETH6 and server on ETH7.

It is certainly the problem if you are trying to do DHCP relay between the devices on the Bridge and devices on the Internal network, because there will be no route between the two LANs.

Hi Doulglas. 

Thank you for your concern. 

The main ideia is to have the UTM as a layer 2 device. COMPANY router --> UTM --> LAN.  The UTM must allow all the traffic coming from the Internet. 

I put an IP adress in the bridged interface. Web access started working, but only if I put web filter in Standard Mode or disabled . If I put it transparent or Full Transparent, it blocks: 

2019:05:29-12:55:02 utm httpproxy[26589]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="192.168.0.120" dstip="161.69.169.22" user="" group="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2499" request="0xda40e00" url="https://161.69.169.22/" referer="" error="Network is unreachable" authtime="0" dnstime="1" aptptime="180" cattime="217" avscantime="0" fullreqtime="312737" device="0" auth="0" ua="" exceptions="" category="9998" reputation="unverified" categoryname="Uncategorized"

I tested to block some categoty sites but stragely it allows the sites. 

Do you have any ideia what it can be? 

Thank you once more 

Olá Marco,

There are several things I would change:

1. In DNS 'Allowed Networks', put only "Bridge01 (Network)" and "Internal (Network)" so that you aren't offering DNS to the outside world.
2. Your "Bridge01" interface shouldn't need to have an IP.
3. You shouldn't need to have the DHCP relay configured unless "DHCPSERVER" is in "Internal (Network)' - in which case, you also need "Internal" in 'Interfaces'.
4. Rather than an 'Any -> Any -> Any' firewall rule, make one like 'Bridge01 (Network) & Internal (Network) -> Any -> Bridge01 (Network) & Internal (Network)'.  Then make a rule for each network like 'Bridge01 (Network) -> DNS & Web Surfing -> Internet'.
5. You also need a Masq rule like 'Bridge01 (Network) -> External'.
6. In Web Filtering, instead of "Any" in 'Allowed Networks', follow the recommendation in 1 above.

I'm confused that your External interface doesn't show that it's getting an Internet connection.

Once al those things are addressed, does Full Transparent work for you?

Cheers - Bob

Olá Marco,

There are several things I would change:

1. In DNS 'Allowed Networks', put only "Bridge01 (Network)" and "Internal (Network)" so that you aren't offering DNS to the outside world.
2. Your "Bridge01" interface shouldn't need to have an IP.
3. You shouldn't need to have the DHCP relay configured unless "DHCPSERVER" is in "Internal (Network)' - in which case, you also need "Internal" in 'Interfaces'.
4. Rather than an 'Any -> Any -> Any' firewall rule, make one like 'Bridge01 (Network) & Internal (Network) -> Any -> Bridge01 (Network) & Internal (Network)'.  Then make a rule for each network like 'Bridge01 (Network) -> DNS & Web Surfing -> Internet'.
5. You also need a Masq rule like 'Bridge01 (Network) -> External'.
6. In Web Filtering, instead of "Any" in 'Allowed Networks', follow the recommendation in 1 above.

I'm confused that your External interface doesn't show that it's getting an Internet connection.

Once al those things are addressed, does Full Transparent work for you?

Cheers - Bob