How connect to an internal sub net behind UTM9

Question

This is my network structure: 
 
 The Computers on the internal network are setup as 10.0.0.x/24 as well as the definition of the network on UTM9. 
 Behind the UTM9 firewall there is the Fritzbox, which is the gateway to the internet. For the FritBox I have assigned a 10.0.10.x/24 network. 
 When I define a new firewall rule under Network Protection, to connect the 10.0.0.x/24 network to the 10.0.10.x/24 network in both direction for any IP protocol, should it than possible to connect to the FritzBox from the internal Computers? Also the IP-Phones need the connection to the FitzBox! 
 Before I have installed Sophos, I had a working VPN connection to another Fritzbox. If I setup also an additional firewall rule under Network Protection for the 192.168.178.0/24 network, should than again work this VPN? 
 Of cource, the above rules must be placed before the internet connection, so that Sophos UTM will the handle first! 
 I ask these questions, because I am not able to test it with the risk, that the connection to the internet will be disconnected, because I am runing an private Web-Radio and I don't want to interrupt my listeners! 
 
 Thanks a lot for your support! 
 ** Summary ** 
 Due to the fact, that it is a lot to read, I try summary it. But first, many thanks to Phillipp for his help and patience. 
 It is important, that the internal network 10.0.0.0/24 and the Fritzbox network 10.0.10.0/24 are indepandant and also all clients in this networks have a 255.255.255.0 mask! 
 Therefore in the Fritzbox the DHCP-server has to be enabled, that clients on WLAN will get a IP. For that I have for the DHCP-Server set the gateway to the Fritzbox, but the DNS to an DNS-Server inside the internal Network. 
 In the Fritzbox under Home network->network properties->Static routing table you have to setup a entry for the internal network and the gateway has to be the external Sophos port on the Fritzbox network. 
 Finally in Sophos you need under network Protection->Firewall->Rules there is an entry necessary, which allows the traffic between the internal network and the FritzBox network. 
 Than everything should work, including WLAN. 
 For the VPN I have setup a new VPN connection between the external FritzBox and Sophos.

jprusch · Accepted Answer

Hello, 
 of course these need to be two separate networks, because this is on two different interfaces of your firewall! Otherwise it would be difficult for the linux kernel to decide the routing between these nets... 
 Once again: all /8 masks are WRONG, you have to change these to /24 an ANY clients. The 10.0.0.0 /8 network is including the 10.0.10.0 /24 network, so this would not work. 
 Now to your second question: The Fritzbox is the Accesspoint for your wireless clients. It will handout DHCP-addresses from the 10.0.10.0 /24 network to the Wifi-Clients. You could start with 10.0.10.100 and end with 10.0.10.200 for example. Mask is /24. 
 Then normal routing is happening to these clients: if they want to reach ressources in the 10.0.0.0 network, the Fritzbox forwards these packets to the Sophos. Of course you need to allow that traffic with a firewall rule. That's it. 
 
 Third question: all mebers of the same IP network should use the same subnet mask. So, yes, your Phones will work again, if they use the same mask as the Fritzbox. 
 [Edit: typos and clarifications]

jprusch · Answer

Hello, 
 can you show us a screenshot from your interface setup of both interfaces "10.0.0.7/24" = internal and "10.0.10.2/24" = WAN, please? 
 Your setup uses the Fritzbox as a default gateway, which is doing NAT for you, too. So the interface on the UTM going to the Fritzbox has to have the attribute "default gateway". 
 The fritzbox on the other end needs to know about the network "behind" the UTM, you can define this network at the fritzbox itself. 
 Bes setup would be to define the Sophos UTM as "exposed host" on the fritzbox, which then sends everything coming in from external to the UTM.

jprusch · Answer

Hallo Hans-Georg, 
 Also ich mache dann mal in deutsch weiter: "Erweiterte Ansicht" bei der Fritzbox ausw&auml;hlen. 
 Unter dem Fritzbox-Men&uuml;punkt "Heimnetz/Netzwerk/Netzwerkeinstellungen" ganz nach unten scrollen bis zum Punkt "Statische Routing-Tabelle". 
 Mit dem Button "neue IPv4 Route" eine neue Route f&uuml;r das interen Netzwerk hinter der UTM anlege. 
 Dort muss f&uuml;r deinen Anwendungsfall stehen: Netzwerk: 10.0.0.0 Subnetzmaske: 255.255.255.0 Gateway: 10.0.10.2 (=Sophos externer Port) 
 Achtung: im Diagramm stehen /8 Netzwerkmasken, die d&uuml;rfen nicht so bleiben. 
 Wenn du die Clients im internen Netz umsteckst, muss nat&uuml;rlich die Sophos Schnittstelle 10.0.0.7 deren Default-GW sein.

jprusch · Answer

Hello, 
 can you please read my post for the route again carefully? 
 The net is 10.0.0.0.

jprusch · Answer

Hello, 
 the logic behind a firewall is quite simple: the UTM is a "Deny ALL" system, so everything you don't allow explicitely is not going though and dropped. 
 But you need to have a network with a functional routing BEFORE, so that the traffic would flow into the right direction. 
 THEN you can decide, what kind of traffic you would like to allow. 
 That said, I come to your questions: we cannot know, which ressources you need to access from where. 
 Based on your network-diagram, I can only guess here: IF a client from the "Wifi-Zone" needs to access the server on the internal LAN, you need a rule to allow that access in this direction. You do NOT need to allow the server to access the Wifi-Clients to achieve that. 
 This is done implicitely: the firewall associates the incoming (allowed) request-packets with the outgoing packets going back to the source of this session. So you always define only "one direction" in firewall rules, when allowing access.

How connect to an internal sub net behind UTM9

Top Replies