How connect to an internal sub net behind UTM9

Hello,

can you show us a screenshot from your interface setup of both interfaces "10.0.0.7/24" = internal and "10.0.10.2/24" = WAN, please?

Your setup uses the Fritzbox as a default gateway, which is doing NAT for you, too. So the interface on the UTM going to the Fritzbox has to have the attribute "default gateway".

The fritzbox on the other end needs to know about the network "behind" the UTM, you can define this network at the fritzbox itself.

Bes setup would be to define the Sophos UTM as "exposed host" on the fritzbox, which then sends everything coming in from external to the UTM.

Hallo Philipp, I hope these are the right screenshoots!

This is a screenshoot from trhe FritzBox.

What do you mean with, the FritzBox has to known about the netwerk behind the Sophos interface?

Currently I still a connection between the FritzBox and the internal network, to get everything working!

Thans for your help,

Hans-Georg

The Wifi of a Fritzbox is bridged to the LAN. As long as there is a valid route the "new" internal LAN 10.0.0.0/24, the Wifi will work for the internal resources as well. You need to have a firewall rule for access to the 10.0.0.0/24 net from 10.0.10.0/24 net, of course. Be careful not to put "any to any" here.

Hallo Phillip,

now it gets complcated.

Do I need this firewall rule for both directions or only for 10.0.0.0/24 to 10.0.10.0/24, because Fritzbox sends the 10.0.0.0/24 already to internal network?

I also don't understood what you mean with careful with put "any to any"?

Because all trafic should be routed from the internel Network to the Fritzbox WLAN!

This is my currentl rule, but not enabled yet.

Thanks,

Hans-Georg

Hello,

the logic behind a firewall is quite simple: the UTM is a "Deny ALL" system, so everything you don't allow explicitely is not going though and dropped.

But you need to have a network with a functional routing BEFORE, so that the traffic would flow into the right direction.

THEN you can decide, what kind of traffic you would like to allow.

That said, I come to your questions: we cannot know, which ressources you need to access from where.

Based on your network-diagram, I can only guess here: IF a client  from the "Wifi-Zone" needs to access the server on the internal LAN, you need a rule to allow that access in this direction. You do NOT need to allow the server to access the Wifi-Clients to achieve that.

This is done implicitely: the firewall associates the incoming (allowed) request-packets with the outgoing packets going back to the source of this session. So you always define only "one direction" in firewall rules, when allowing access.

Hello Phillip,
thanks a lot!

1. So if you say,

PhilippRusch said:

Be careful not to put "any to any" here.

that means, I should not let any traffic comming through the firewall, right?

2. And you say, that I only have to define firewall rules for the incomming traffic and not for the outgoing traffic!

3. So my firewall rules: Internal (10.0.0.0/24) to Fritz (10.0.10.0/24 and Internal to any (0.0.0.0/0) are useless?

4: I have Nat rules from any for specific ports to an specific address for a specific Port. So this one works also automatically in the other direction. And I have a Mask rule for internal (10.0.0.0/24) to the externalSopjos  interface (10.0.10.2). Is this necessary?

5. From the Fritzbox there is comming Traffic from the Internet and also from the VPN and the WLAN. So if I have firewall rule from 10.0.10.0/24 to 10.0.0.0/24 I can use any, because only  the traffic from 10.0.10.0/24 can go trought the firewall but not the internet traffic, which uses the same way? Ofcourse it would better not to use any and only the necessary traffic!

6 Whit NAT I define specific traffic, for example a port which goes to an specific maschine and with a firewall rule defines the traffic between busses, right?

7. The static rule of the Fritzbox tells the Fritzbox to which port the Fritzbox has to send which traffic, I think.

I think I now understand the network of the firewall now much better.
Vielen Dank,

Hans-Georg

Hallo Phillip,

I was able to implement your recommended changes on the Fritzbox:

I am happy, that I have done during the night, because the Fritzbox has reseted the "Portfreigaben", so that first no internet was working anymore.

If I remove the direct physical connection from the Fritzbox to the internal network, I cannot connect the FRitzbox.

A network rule between the the 10.0.0.0/24 and 10.0.10.1/24 in both direction exists.

If I use the Sophos Tools Ping I got:

But if I use my PC for a Ping to 10.0.10.0 there is no connection.

What could be the problem?

You can't ping 10.0.10.0, this is the network as a whole, no host.

Sorry, this was just an typing error, I tried to Ping 10.0.10.1!

Have a look here:

Hello Phillipp,

have implemented your propoasals for Global ICMP and Ping Settings, but I still cannot ping or access 10.0.10.1 from the internal 10.0.0.0 netzwork!

What could I do next?

Regards from Germany, too

Hello,

I know we are both german, but let's keep this thread in english, maybe some other community users have a useful insight of our discussion.

Back to your topic: how is the client configuration you use for the test?

Can you output the ip configuration here?

Hello,

I know we are both german, but let's keep this thread in english, maybe some other community users have a useful insight of our discussion.

Back to your topic: how is the client configuration you use for the test?

Can you output the ip configuration here?

or do you need /all?

Thanks,

Hans-Georg

Ja, da habe ich mir gedacht: bitte die Subnetzmaske auf 255.255.255.0 (=/24) korrigieren.

Außerdem würde ich IPv6 komplett abschalten.

Ups, jetzt habe ich ja selber auf deutsch umgeschaltet:

Please correct the subnet mask to 255.255.255.0 (=/24).

BTW: I would completely disable IPv6.

Hallo Phillipp,

yes, now it works, but I have now some additial questions.

So I have now 2 independant networks. 10.0.0./24 for internal and 10.0.10.0/24 for the Fritzbox network!

I guess, I have to set all oter Computers in the internal network also to the mask 255.255.255.0, right?

So Computer, which connect via WLAN now on a separate network (10.0.10.0/24) .
The next step should be to activate the DHCP-server on the Fritzbox, because the DHCP on the internel network is no longer availble?
Can the Fritzbox DHCP-server provide an IP from the 10.0.0.0/24 network?
If not, are then all computes on the WLAN still able to connect to the computer in the 10.0.0.0/24 netwerk?
My IP-phones which need a connection to the Fritzbox, if I change there network mask also to 255.255.255.0, would they work again?

Best regards and thanks you very much,

Hans-Georg

Hello,

of course these need to be two separate networks, because this is on two different interfaces of your firewall!  Otherwise it would be difficult for the linux kernel to decide the routing between these nets...

Once again: all /8 masks are WRONG, you have to change these to /24 an ANY clients.
The 10.0.0.0 /8 network is including the 10.0.10.0 /24 network, so this would not work.

Now to your second question: The Fritzbox is the Accesspoint for your wireless clients. It will handout DHCP-addresses from the 10.0.10.0 /24 network to the Wifi-Clients. You could start with 10.0.10.100 and end with 10.0.10.200 for example. Mask is /24.

Then normal routing is happening to these clients: if they want to reach ressources in the 10.0.0.0 network, the Fritzbox forwards these packets to the Sophos. Of course you need to allow that traffic with a firewall rule. That's it.

Third question: all mebers of the same IP network should use the same subnet mask. So, yes, your Phones will work again, if they use the same mask as the Fritzbox.

[Edit: typos and clarifications]

Hello Phillipp,

thank you very much. I have learned a lot about networks. Now my network is running well and I only have to setup the VPN.

Vielen Dank,

Hans-Georg