This is my network structure:
The Computers on the internal network are setup as 10.0.0.x/24 as well as the definition of the network on UTM9.
Behind the UTM9 firewall there is the Fritzbox, which is the gateway to the internet. For the FritBox I have assigned a 10.0.10.x/24 network.
When I define a new firewall rule under Network Protection, to connect the 10.0.0.x/24 network to the 10.0.10.x/24 network in both direction for any IP protocol, should it than possible to connect to the FritzBox from the internal Computers? Also the IP-Phones need the connection to the FitzBox!
Before I have installed Sophos, I had a working VPN connection to another Fritzbox. If I setup also an additional firewall rule under Network Protection for the 192.168.178.0/24 network, should than again work this VPN?
Of cource, the above rules must be placed before the internet connection, so that Sophos UTM will the handle first!
I ask these questions, because I am not able to test it with the risk, that the connection to the internet will be disconnected, because I am runing an private Web-Radio and I don't want to interrupt my listeners!
Thanks a lot for your support!
** Summary **
Due to the fact, that it is a lot to read, I try summary it.But first, many thanks to Phillipp for his help and patience.
It is important, that the internal network 10.0.0.0/24 and the Fritzbox network 10.0.10.0/24 are indepandant and also all clients in this networks have a 255.255.255.0 mask!
Therefore in the Fritzbox the DHCP-server has to be enabled, that clients on WLAN will get a IP. For that I have for the DHCP-Server set the gateway to the Fritzbox, but the DNS to an DNS-Server inside the internal Network.
In the Fritzbox under Home network->network properties->Static routing table you have to setup a entry for the internal network and the gateway has to be the external Sophos port on the Fritzbox network.
Finally in Sophos you need under network Protection->Firewall->Rules there is an entry necessary, which allows the traffic between the internal network and the FritzBox network.
Than everything should work, including WLAN.
For the VPN I have setup a new VPN connection between the external FritzBox and Sophos.
Hello,
of course these need to be two separate networks, because this is on two different interfaces of your firewall! Otherwise it would be difficult for the linux kernel to decide the routing between…
can you show us a screenshot from your interface setup of both interfaces "10.0.0.7/24" = internal and "10.0.10.2/24" = WAN, please?
Your setup uses the Fritzbox as a default gateway, which is doing NAT for you, too. So the interface on the UTM going to the Fritzbox has to have the attribute "default gateway".
The fritzbox on the other end needs to know about the network "behind" the UTM, you can define this network at the fritzbox itself.
Bes setup would be to define the Sophos UTM as "exposed host" on the fritzbox, which then sends everything coming in from external to the UTM.
Mit freundlichem Gruß, best regards from Germany,
Philipp Rusch
New Vision GmbH, GermanySophos Silver-Partner
If a post solves your question please use the 'Verify Answer' button.
Hallo Philipp, I hope these are the right screenshoots!
This is a screenshoot from trhe FritzBox.
What do you mean with, the FritzBox has to known about the netwerk behind the Sophos interface?
Currently I still a connection between the FritzBox and the internal network, to get everything working!
Thans for your help,
Hans-Georg
Hallo Hans-Georg,
Also ich mache dann mal in deutsch weiter: "Erweiterte Ansicht" bei der Fritzbox auswählen.
Unter dem Fritzbox-Menüpunkt "Heimnetz/Netzwerk/Netzwerkeinstellungen" ganz nach unten scrollen bis zum Punkt "Statische Routing-Tabelle".
Mit dem Button "neue IPv4 Route" eine neue Route für das interen Netzwerk hinter der UTM anlege.
Dort muss für deinen Anwendungsfall stehen: Netzwerk: 10.0.0.0Subnetzmaske: 255.255.255.0Gateway: 10.0.10.2 (=Sophos externer Port)
Achtung: im Diagramm stehen /8 Netzwerkmasken, die dürfen nicht so bleiben.
Wenn du die Clients im internen Netz umsteckst, muss natürlich die Sophos Schnittstelle 10.0.0.7 deren Default-GW sein.
Hallo Phillip,
so I have to set the subnet mask to 255.255.255.0 add the static routing.
But what'sthe additional firewall rules under Network Protection?
Do I need them both?
Viele Grüße,
Which rules?
Hallo Phillipe,
HGA said:When I define a new firewall rule under Network Protection, to connect the 10.0.0.x/24 network to the 10.0.10.x/24 network in both direction for any IP protocol, should it than possible to connect to the FritzBox from the internal Computers? Also the IP-Phones need the connection to the FitzBox! Before I have installed Sophos, I had a working VPN connection to another Fritzbox. If I setup also an additional firewall rule under Network Protection for the 192.168.178.0/24 network, should than again work this VPN?
I am not sure, if I need them! I think, Sophos automatically send the trafic for 10.0.10.x and for 192.168.178.x to the Fritzbox and the Fritzbox understand that these are not external IPs and the Fitzbox automatically use the VPN?
So setup the static routing on the Fritzbox is all I have to do?
Your Gateway definition tells the Sophos to send everything which is not destinated to 10.0.0.0 to the router (= Fritzbox) with the 10.0.10.1.There is no magic behind this.
You certainly have to allow traffic from internal LAN to "the internet" for you internal clients. That's one kind of rule.
The other part is your existing VPN.
I would recommend to use the Fritzbox function "exposed host" under the "Freigaben" (Portforwarding) menu and then terminate the VPN on the Sophos UTM.
Phillip thank you very much,
I have already use the function "exposed host".
But what you mean with terminate the VPN on the Sophos UTM?
On the UTM I don't have any VPN setup!I will test it tonight!
Best regards from Germany,
To terminate the VPN means, the VPN-Tunnel is ending here.
But my recommendation has to be clarified: if you have a site-to site-Tunnel between two Fritzboxes, then leave this like it is.
If you want to add remote-VPN-Access für some Clients, you should definitely use the built-In VPN features of the UTM.
They are much simpler to configure and to install, than the Fritzbox IPsec VPN-Clients.
For VPN-Clients you better use the SSL-VPN of the UTM.
Good Morning Phillip,
ok, I can leave the existing VPN-Tunnel between the 3 GFritzboxes, it is exist andcontinue try to get it working!
But I have testet tonight your proposed settings about the 10.0.x.x networks but I didn't get it working.
First I setup the stativ IPv4-route under Heimnetz->Netzwerk->Netzwerkeinstellungen as you proposed.
This one is currently still enabled, but if I tried to change the subnet mask under IP-Adressen from 255.255.255.0 to 255.0.0.0 under IPv4-Einstellungen, I lost the connection. I had to change the network adapter settings for one machine to 10.0.10.10 with the network mask 255.255.255.0 to have again access to the Fritzbox (10.0.10.1) and reset this settings.
I think, 10.0.10.0/24 is in generell a part of 10.0.0.0/8, but the Fritzbox doesn't allow the access outside the 10.0.10.0/24 network!
What was my mistake?
Best regards,